hello , i want to detect foreign ip at first step, then search in traffic for connections between foreign ip and other local ips.   | tstats `security_content_summariesonly` values(All_Traffic.src_ip) AS src values(All_Traffic.dest_ip) AS dest values(All_Traffic.dest_ip_Country) AS dest_country values(All_Traffic.src_ip_Country) AS src_country from datamodel=Network_Traffic by _time | eval attacker=if(src_country="","$src$","$dest$") | search [ | tstats count from datamodel=Network_Traffic WHERE (All_Traffic.src_ip=attacker OR All_Traffic.dest_ip=attacker) by _time ]   ... View more

hello everyone I have an ISF for send stream logs to my Splunk indexer  the logs in  "/opt/streamfwd/var/log" show that this error is happening: 2021-12-03 22:56:08 ERROR [140397528004352] (HTTPRequestSender.cpp:1408) stream.SplunkSenderHTTPEventCollector - (#7) HTTP request [https://splunk:8088/services/collector/event?index=_internal&host=stream&source=stream&sourcetype=stream:log] response = 400 Bad Request {"text":"Incorrect index","code":7,"invalid-event-number":1} ... View more