Hi, There is an issue in your data indexing. make sure you set correct index in your add-on inputs.conf and make sure your index is already created. ... View more

Hi, first check if user has appropriate permission in Manage Apps, find your specific app and click on Permissions then check if the app is visible  Select Apps > Manage Apps then click Edit properties for the app  you want to edit make sure Visible set to YES https://docs.splunk.com/Documentation/Splunk/8.2.6/Admin/Managingappconfigurationsandproperties   ... View more

Hi, Some of Dashboards in apps use Data Model for searching. so you should accelerate the data model. you can set Acceleration from Web GUI in "Settings>Data Models" then find data model "Fortinet FOS Log" click on "Edit" and press "Edit Acceleration" then check Accelerate and set Summary Range and Save. Data Model Acceleration time depends on your objects and Summary range so you have too wait for a while then go back check your dashboards. More info about Accelerate Data Models : https://docs.splunk.com/Documentation/SplunkCloud/latest/Knowledge/Acceleratedatamodels How to Accelerate Data Model: https://docs.splunk.com/Documentation/CIM/5.0.1/User/AccelerateCIMdatamodels Good Luck ... View more

It also can be installed via extracting the package and copy them into "$SPLUNK_HOME/etc/app/" individually. In this case you should restart splunkd service via command "$SPLUNK_HOME/bin/splunk restart" or from WebGUI in "Setting>Server Control>Restart Splunk" More Info about Exchange add-on:  https://docs.splunk.com/Documentation/MSExchange/4.0.4/DeployMSX/AboutSplunkforMicrosoftExchange More Info about Add-on Installation (Single-Instance):   https://docs.splunk.com/Documentation/AddOns/released/Overview/Singleserverinstall More Info about Add-on Installation (Distributed): https://docs.splunk.com/Documentation/AddOns/released/Overview/Distributedinstall ... View more

i have the same issue. i dont know what sourcetype should be set in input file. srx forwarding logs via syslog on UDP:514. any help? ... View more