Hi Steve, I was wondering whether you have a fix for this. We are facing the same problem as well.  Any hint will be appreciated.  ... View more

You deserve all the kudos.  We had app and custom did the trick.  ... View more

Hi Sorry for the long shot.  Yes, I did find a way to make it work for a while. Just get the refresh token in and it will automatically work until that you have to tune it.        ... View more

Hi @yuanliu  You are a true legend. It worked.  The reason why it was not working due to key and value needs to be lower case.  | eval server_name = mvindex(Tags_value, mvfind(Tags_key, "Name"))  Now the magic server_name is populated now.  Thank you.  ... View more

Hi @yuanliu , Thank you for your help so far. You have been amazing! We do have two fields called: detail.resource.instanceDetails.tags{}.key detail.resource.instanceDetails.tags{}.value The value looks like below: And I have ran the search likes below, nothing returned. I also tried to remove  .value in line 4. It didn't make a difference, have I done any thing wrong?  Cheers, Freddy ... View more

Thank you for the prompt reply.  Please see if below works for you: [ { "Resource": { "InstanceDetails": { "Tags": [ { "Key": "AWS_Backup", "Value": "Yes" }, { "Key": "Schedule", "Value": "pre-hours" }, { "Key": "Name", "Value": "HOST-NAME" }, { "Key": "Application Owner", "Value": "XXX" }, { "Key": "Environment", "Value": "XXX" }, { "Key": "Eco System", "Value": "XXX" }, { "Key": "Patch Group", "Value": "XXX" }, { "Key": "ScheduleMessage", "Value": "XXX" }, { "Key": "Application", "Value": "MuleSoftESB" }, { "Key": "Cost Centre", "Value": "XXX" } ] }, "ResourceType": "Instance" } } ]   ... View more

Hi @yuanliu , Thanks for your answer. It looks interesting.  But I'm having problems getting the result I wanted.  Sample data looks like below(I probably haven't closed brackets properly, but you get the idea) detail: { [-] resource: { [-] instanceDetails: { [-] tags: [ { [-] key: AWS_Backup value: Yes } { [-] key: Schedule value: pre-hours } ] } }   my search looks like: index=example_index sourcetype="aws:cloudwatch:guardduty" | spath | rename detail.resource{}.instanceDetails{}.tags{}.* as tags_* | eval host_name = mvindex(tags_value, mvfind(tags_key, "Name")) After hitting the search button, nothing came up.  If I add table host_name the value is empty.  It you could please point out errors, that would be awesome. Thank you.   ... View more

Did you make it work? What was your issue? ... View more

Hi @splunkoptimus,   Our issue was caused by a missing label. So we have label "threat" configured in Phantom but not in SOAR. So SOAR was throwing error due to no matching label found.  Hopefully that helps.      ... View more

Clicked on the wrong post to reply, but yeah. It came to me mind a bit too late. lol. Thank you. ... View more

Hi @bowesmana  Thank you so much.  It's working after I deploy it onto the indexer cluster.    ... View more

@bowesmana   Hi thank you for the reply.  I have added these two line on props.conf on universal forwarder as well as search heads cluster. It seems like we are still getting same error.      ... View more

Hi @bowesmana ,   Thank you for the answer.  I think I haven't been explained the question well.  If you see the screenshot below, the problem is that these logs are not breaking line properly. That's why I was thinking that it could be caused by props.conf. ... View more

That worked beautifully for us. Thank you. ... View more

Hi @gcusello , Thank you for the detailed explanation! Done done.    Cheers, Freddy ... View more

Hi @gcusello  Again, I really apprecaite your help. The logging is back now after I pushed the TA contains that props.conf into our indexer cluster, you were right. Indexers had no idea what time the should use. But one thing that still doesn't make sense to me is why it doesn't know how to handle logs from the 1st until the 11th of the month ... View more

Hi @gcusello   Thank you so much for the answer.  That's very interesting. I thought having the TA in universal forwarder would make sure the date extracted properly.  Thank you. I will deploy this TA on our indexer clusters. But does the props.conf look good to you?  ... View more

Hi @gcusello , Thanks for the reply. Good question. It's being deployed on the Universal Forwarder by Deployment server and I don't think it's on indexers.  But it was working just fine before, just don't understand how that date change would affect this.    Cheers, Freddy ... View more

I'm very grateful that you spent you time on helping me as well.  Thank you. ... View more