Either on $SPLUNK_HOME/etc/apps/{App where the source comes from}/fields.conf or $SPLUNK_HOME/etc/system/local/fields.conf, set the following configuration: [source] INDEXED = False Restart Splunk. NOTE: For Cloud users, have Support do this for you. To my understanding, this is the reasoning behind this: INDEXED=True Setting this attribute to True, tells Splunk that the source has already been extracted during index-time. When we run a search with that source, Splunk will look for events that have "aws.guardduty" as their source (metadata). INDEXED=False Setting this attribute to False, tells Splunk that the source will need to be extracted during search-time. When we run a search with that source, Splunk will look for events that have "aws.guardduty" in their events (raw data). Otherwise, it will not find anything because the source was not extracted during index-time. Find documentation here: https://docs.splunk.com/Documentation/Splunk/8.0.3/Admin/Fieldsconf ... View more

Hi Jeremyfer, I work on Cloud Support and I am currently checking on a case with this issue. Have you opened a case with Support? ... View more

I'm unsure if this is what you are looking for, but I'm pasting this response for a few questions about this add-on not loading. If this is your issue, try this: vi /opt/splunk/etc/apps/Splunk_TA_microsoft-cloudservices/bin/splunktamscs/ca_certs_locater.py Look for TEMP_CERT_FILE_PATH and update it to '/etc/pki/tls/certs/ca-bundle.crt' TEMP_CERT_FILE_PATH = '/etc/pki/tls/certs/ca-bundle.crt' Save the changes and restart Splunk Please let us know if this works for you. https://splunkcommunities.force.com/customers/apex/ArticleDetailPage?URLName=Add-on-Microsoft-Cloud-Services-The-Add-on-Gets-Stuck-Loading-the-Screen ... View more

Try this: vi /opt/splunk/etc/apps/Splunk_TA_microsoft-cloudservices/bin/splunktamscs/ca_certs_locater.py Look for TEMP_CERT_FILE_PATH and update it to '/etc/pki/tls/certs/ca-bundle.crt' TEMP_CERT_FILE_PATH = '/etc/pki/tls/certs/ca-bundle.crt' Save the changes and restart Splunk Please let us know if this works for you. https://splunkcommunities.force.com/customers/apex/ArticleDetailPage?URLName=Add-on-Microsoft-Cloud-Services-The-Add-on-Gets-Stuck-Loading-the-Screen ... View more

Try this: vi /opt/splunk/etc/apps/Splunk_TA_microsoft-cloudservices/bin/splunktamscs/ca_certs_locater.py Look for TEMP_CERT_FILE_PATH and update it to '/etc/pki/tls/certs/ca-bundle.crt' TEMP_CERT_FILE_PATH = '/etc/pki/tls/certs/ca-bundle.crt' Save the changes and restart Splunk Please let us know if this works for you. https://splunkcommunities.force.com/customers/apex/ArticleDetailPage?URLName=Add-on-Microsoft-Cloud-Services-The-Add-on-Gets-Stuck-Loading-the-Screen ... View more