Hello, we have a requirement for this as well. Is there any update to this discussion? We have a need to integrate data sourced from ThreatResponse into our splunk solution. ... View more

Hello @Manami , We are experiencing the same thing with Splunk Enterprise, Memory utilization on average went up ~30% and CPU load over 50% across the indexing tier when we moved to this version. I will let you know if anything is found with the recent case which was opened. Were you able to find the problem with the universal forwarder?   ... View more

The same thing is happening to us. We have seen that the Splunkd process takes up to 12 GB of RAM on clustered search heads when previously it was using 4-5 GB.  ... View more

Thanks, this fixed my problem when updating my inputs.conf. I was also missing the SSL stanza. ... View more

Hello HiMAT-Mode, Did anything come of your case with Splunk on this? Our cloud engineering team has the same question regarding whether or not they will update the TA to support this. Thank you!   ... View more

This solution worked in our environment. ... View more

Are there any plans on updating the app to create new visualizations using the Cost and Usage Report? ... View more

Did you ever find a resolution to this issue? We are encountering the same thing. ... View more

Thank you, this is very useful! ... View more

This solution worked for me, thank you briancronrath. One thing that I had to do was ad an additional AS with the portion which says |stats values(field3) AS field3 [|inputlookup field3_lookup |table field3 | dedup field3 |stats values(field3) AS field3 |addinfo | eval temp=info_min_time."##".info_max_time | makemv temp delim="##" | mvexpand temp | eval _time=temp | timechart span=1m values(field3) as field3 | eval field3=mvjoin(field3,";") | streamstats last(field3) as field3 | makemv delim=";" field3 | mvexpand field3 | eval field1=0 | eval field2=0 | eval field4="possibility1;possibility2;possiblity3" | makemv field4 delim=";"| mvexpand field4] ... View more

Will this send the output to a file which can then be read by splunk? ... View more