I'm trying to send some busy logs through a Heavy Forwarder into our Splunk Cloud so we can do some aggregation to reduce the volume hitting the Cloud IDM. The feeds are picked up via Pub/Sub topics in GCP and when they're transferred to the Heavy Forwarder, the volume of events coming through is only about 5% of the volume that was hitting the Cloud IDM. Nothing has been changed on the GCP side and the VM running the Heavy Forwarder is highly spec'd and is showing virtually no load on CPU, memory or networking. Any ideas as to what could be wrong? Thanks ... View more

I'm trying to use the CIM to look at some firewall data in the InfoSec app. I've setup the event tagging and field aliases but I'm getting different results when searching using the Datamodel in the InfoSec dashboard vs using a base search. Here are the two searches I'm using, anyone know why they are providing different results? Datamodel: | tstats prestats=true local=false summariesonly=true allow_old_summaries=true count from datamodel=Network_Traffic.All_Traffic where * by _time, All_Traffic.action span=10m  | timechart minspan=10m count by All_Traffic.action Base: tag=communicate tag=network | stats count by _time,action | timechart minspan=10m count by action Thanks ... View more