No data at all ... View more

Looks like it worked, as I can see a log for adding the monitor succeeding: "Audit:[timestamp=11-10-2021 15:59:57.839, user=admin, action=edit_monitor, info=granted object="/tmp/logs/implantbase/node. log" operation=create]" (From audit.log) Although I'm not sure why it's an action of "edit_monitor" instead of "add", but it has an operation of "create" so seems intended? ... View more

Please create an app on the forwarder with inputs.conf which has the below format   [monitor:///var/log/httpd] sourcetype = access_common index = abc ignoreOlderThan = 7d   Download the splunk UF credential package app from splunk cloud and place it in /opt/splunkforwarder/etc/apps location and do a splunk restart   ... View more

Hi! I followed the same tutorial and ran into the same error while attempting to deploy. Have you found any success with this yet? Thanks ... View more