Hi Experts, Question: Anyone know how to change the STS endpoint to private VPCe Interface address when adding an account to ADD-ON for AWS during setup?   I am trying to deploy Splunk on a VM in private subnet (no route to the internet) in a VPC in AWS, and to index data on S3 (and more later). Currently, I have set up VPC endpoint (interface) for S3 and STS, and confirmed those 2 endpoints are accessible from the VM via an account from awscli. When I tried to add an account in add-on Account setup, add-on actually tried to talk STS through public STS which the private network does not have route to.  I would like to change add-on configuration to have the addon talk to private STS VPCe address to complete the setup/adding an account. If there is another way to have splunk run in a private subnet, I would like to know about it. Any comment would be appreciated.. Thank you!  ... View more

Hi Expert, I am trying to confiture transforms that has multiple condition for match, with the following condition:     (word1 OR word2) AND word3 NOT ('phrase 4' OR 'phase 5')     and I tried the following config, but still no luck.     [source::.../input.log] REGEX =^(?=.*(word1|word2))(?=.*word3)(?!.*(phrase 4|phrase 5)).*$ FORMAT = sourcetype::mytype DEST_KEY = MetaData:Sourcetype     The regex may be wrong or there is another workaround to archive this...  Any comment and/or recommendation would be really appreciated.. ... View more