The explanation for this is that there is a limit on how many results can be returned in a sub-search (right-side of a join). I believe 50k results is the limit. So try to make sure your search is as narrow as possible. ... View more

Are you sending the JSON to HEC? if you want to do custom extraction at index time, make sure you use the HEC URL ending in /collector/raw.   if you use /collector (or /collector/event) endpoint, then it is probably bypassing some customizations. ... View more

that's crazy 😞 ... View more

Did you ever get this working? ... View more

In case anyone else lands here, it appears Cortex Data Lake now supports forwarding directly to Splunk  via HTTP Event Collector (HEC). https://docs.paloaltonetworks.com/cortex/cortex-data-lake/cortex-data-lake-getting-started/get-started-with-log-forwarding-app/forward-logs-to-an-https-server ... View more

Thank you. I was able to accomplish my goal using replace() ... View more

I don't think Cortex Data Lake supports SSL (assuming you mean https). It does support syslog over TLS though. ... View more

I'm also curious about this. ... View more

I'm very familiar with that particular comic lol. I'd recommend inspecting the code for the sendmodalert script (I believe it's supposed to be python??) - if you have direct access to the Splunk Server and are comfortable with it. What I would do is I would try to enhance the error output to include more details - like the domain and/or URL that is causing the error.  Never got those particular errors resolved. I thought they were related to an issue I was having where the splunk server stopped attempting to send any alerts, but that appeared to be caused by something else. ... View more

Thank you! ... View more

Can you provide an update on how you resolved this issue? ... View more