Can try this setting if it helps - syslogseverity severity OUTPUTNEW severity AS severity_auto severity_desc Please refer to https://community.splunk.com/t5/Splunk-Cloud-Platform/Why-can-I-not-expand-lookup-field-due-to-a-reference-cycle-in/m-p/563011/highlight/true#M1055 ... View more

Hello @grep, Can you please try removing whitelisting from the "CIM Setup" page and only have condition available from Macro page? Let me know if it doesn't work and I can troubleshoot. ... View more

As I wrote before - there's a good chance that your HFs don't use AD for authentication and authorization. In typical scenarios it's not needed. You might check /opt/splunk/bin/splunk btool authentication list authentication To see what authentication mechanism is your HF using ... View more