Hi @gcusello , I have noticed the same behaviour, but when i unistalled the app/addon still i see duplicated fields but they are in my raw event as well.  Regards, Bharath Kumar ASN ... View more

Hi @gcusello , Are you referring to the raw events that contains duplicates? If it is in the raw event, then it is nothing to do with the TA or Add-on?  If it is with the raw event itself, may be worth to check the source of the data that is sending the logs to splunk... Only these three fields are having the duplicates or any other fields?   ... View more

Hi, Please run below to get the iowait usage that is being tracked by splunk by default: index=_introspection sourcetype=splunk_resource_usage component=IOWait  Looks like they are taking it from there. Regards, BK ... View more

@damucka , Yes! But these are only displayed when we navigate to inputs, configuration pages that are custom to the add-on's but when we navigate to "search" tab under the Db connect app for example, again the app name disappears from the top left section. same as the case with webtools. ... View more

@rnowitzki , Thanks for taking time in replying. Before writing the question here in the group below are the things that I did: * We are receiving data from three sources on the same port, so that way only one set of data which is not seen extracting from the syslog-ng. * So then, I tried to dump everything irrespective of the host into a different location and i observed that the cyberark logs are stored with the receiver hostname and logs are with the error "error processing log file". * Then i did tcpdump on the host that is receiving the logs and observed that the logs are seen without any error message. * After i realized that this is something related to the syslog-ng configuration then i used lot of rules and templates along with no parse flag, still no luck. Now, again i realized that the no parse flag is not used\set in the way it is supposed to use, then again when i corrected the configuration, i can see the logs are receiving. Thanks a lot for your help, so i would say no parse flag helped me in this case. Regards, BK ... View more

@rnowitzki , Thanks for your inputs, i tried with no parse flag but still no luck.. ... View more

Thanks for your input @anilchaithu , but when we use below it is working without any issues: | eval fieldname2=if(fieldname1="abc","Starting",fieldname2) | eventstats values(fieldname2) as fieldname2 by host | lookup local=true mylookup Key as fieldname2 OUTPUT fieldname3 So placing | eventstats between working fine...and we are using the same cases as it is in the kv store.. ... View more

this is valid only when we have a parent and children, but in my case i have grand children as well... ... View more

We have a lot of indexers, we need to add this to all the indexers??/ ... View more

Hi @rashid47010 , i am setting up the same app and i did the initial setup by provided the credentials to connect to, i am stuck here... when i run the command | abfsearch i am getting the error "ERROR "ValueError at ""/opt/splunk/lib/python2.7/json/decoder.py"", line 382 : No JSON object could be decoded" "" Also as per my understanding this app will invoke rest calls to algosec and only retrieve data when a user uses the app. Is there a way to send the real time data so splunk from algosec?? Your inputs will really help me in setting up the same. Looking forward to hear from you! Thanks in advance! ... View more

@Nadhiyaa, Have you checked the telnet to the ldap server to test the connectivity via the mentioned port?? Regards, BK ... View more