Hi @jbueso, there isn't any Add-On only the App (downalodable from the Mobileiron site) to install on the Heavy Forwarder to enable data inputs. The HF will forward logs to Splunk Cloud. The App for Splunk Cloud is the same without all the scripts that block the upload. In few words, fromthe MobileIron app I took only dashboards and knowledge objects, removing all the Data inputs. Ciao. Giuseppe ... View more

Hi ,  I am looking to integrate Splunk and MobileIron Core. At MobileIron Core end , it is prompting to enter Inder details. Our current architecture is UF->HF->IDX->SH, I am looking for ways to configure either to HFs or IDX cluster ? Is there any docs or leads please?  Also, where to download the app "MobileIron App for Splunk Enterprise"? ... View more

Thanks for answering. In my case I want to locate a marker within the map (which I have previously located with coordinates), the problem is that they are markers with very unintuitive names that do not provide contextual information so if you do not know exactly where is it, you end up in a trial and error process, or end up looking elsewhere (in my case a kmz uploaded on google earth). What I'm looking for is not having to leave splunk to access the data I load in the marker Thanks in advance ! ... View more

Hi jbuesco, this makes no sense: <query> | dbquery ORACLE_SVCM "SELECT count(problems) FROM db1 WHERE STATUS!='closed''" </query> | stats count as value | eval value | rangemap field=value none=0-99 low=100-199 guarded=200-299 elevated=300-399 high=400-499 severe=500-599 default=none The stats part of the search is outside the query tag. Since I don't have any of your events available I can only assume that the following might work for you: <query> | dbquery ORACLE_SVCM "SELECT count(problems) FROM db1 WHERE STATUS!='closed''" | stats count as value | rangemap field=value none=0-99 low=100-199 guarded=200-299 elevated=300-399 high=400-499 severe=500-599 default=none </query> Hope this helps ... cheers, MuS ... View more

This may sound obvious, but did you set up an index called "midevices"? There are three indexes that receive information. midevices mihealth mijvm If you continue to have problems, I suggest you open a ticket with MobileIron support. ... View more

Hi, I have exact the same problem (rhel not windows system) I just follow instructions from http://docs.splunk.com/Documentation/Splunk/latest/Data/SendSNMPeventstoSplunk but I can not receive anything in /var/log/snmp-traps. If I start tcpdump -i eth0 'port 162' I can see snmp events arriving my server, but looks like snmptrapd can not write them into file. Anyone could give me a hint to advance? no iptables or any other firewall is running. Thanks in advance ... View more