Hi Splunkers, We are streaming google app logs to splunk in distributed environment. We have G suite for Splunk app on SH and Input add-on on Heavy forwarder. I am seeing log drop on a particular day for about 2 hrs and then the logging has turned normal. Unable to identify the reason for the same. akasmika_0-1648579964460.png Also the g suite application health dashboard shows the below error, akasmika_1-1648580100762.png @alacercogitatus , could you please help me identify the cause for logs drop and how to fix these errors? ... View more

Hi Splunkers, I have to create an alert when there is a root user login in AWS. For this, I am ingesting cloudtrail logs to distributed splunk env. I want to add organization wide aws accounts to get logs. Adding every single account and creds in Splunk add-on for AWS is difficult. Kindly suggest a way to onboard cloudtrail logs from multiple accounts. Thanks ... View more

Hi Splunkers, I would like to know what happens to logging in below scenarios when there is an outage. I would like to know if splunk restores logging when the systems are back from outage or does it lose the logs. 1. logs are getting forwarded from an app 2.  synced from an S3 bucket 3. pulled via API 4. data coming through heavy forwarder Thanks ... View more

Hi Splunkers, I want to send an alert to Slack when someone logs into an AWS account using the root user. I have Splunk add-on for AWS and Slack add-on already installed. How can I achieve this? Thanks ... View more