Hi @XOJ  Yes, I used Elastic Sources to fix my issue in this case. But thankfully, this issue seems to have been confined to this one app. Other sources behaving as expected.  ... View more

Hi Guilhem, Performing this test of temporary deletion on one of the troublesome sourcetypes and running both short and long term trackers has not re-created the entity in TrackMe.  I can see that new events have been ingested since I deleted it also, even though there is some delay to ingestion due to the nature of the add-on, new events would be more than 24hrs in the past but not more than 7 days, so long term tracker should pick it up (-7d / +4h). Regards, ... View more

A bit more information: Running  |inputlookup trackme_data_source_monitoring where data_name="<index>:<sourcetype>" | eval c_time=strftime(data_last_time_seen,"%m/%d/%y %H:%M:%S") shows that indeed data_last_time_seen is 1636007052 (11/04/21 17:24:12) However running (on the same box as above) | tstats max(_time) as data_last_time_seen WHERE index=<index> sourcetype=<sourcetype> results in data_last_time_seen is 1638662400 (December 5, 2021 11:00:00) ... View more

Hi Guilhem, Clicking on Search from the entity window shows the same data as can be seen in the "Overview data source" tab. Which for example has events at _time =  2021-12-05T11:00:00.000+11:00, however in the same entity window the numbers for data_last_time_seen & data_last_ingest = 04/11/2021  17:24 and latest_flip_time = 06/11/2021 05:30, which lines up with the data_max_lag_allowed, but as discussed does not line up with actual events ingested (same index and sourcetype). All other sourcetypes are not showing this kind of behaviour and are functioning/tracked as expected. @guilmxm  ... View more

Hi @guilmxm  Thanks for replying. I should have stated the Status message originally.  The Status message reads: monitoring conditions are not met due to lagging or interruption to data flow. Looking at smart_result in Smart Status "while the latest data available is: " is the same time and date as data_last_time_seen Would agree that it is strange that new events coming in (which still have an _time field) is not being recognised as before. Current beginning of log structure: {"reportRefreshDate": "2021-12-04T00:00:00Z", etc. etc. Old beginning of log structure: {"@odata.type": "#microsoft.graph.teamsUserActivityUserDetail", "reportRefreshDate": "2021-11-02" etc. etc. Regards, ... View more

Also, check your authorize.conf file, start with the one in SPLUNK_ROOT/etc/system/local If this file has srchIndexesAllowed variable configured and your index isn't in that list, search will show zero results on that index, even though the front-end displays all Roles and Indexes as searchable in Settings. ... View more