Hello all, When we try to create a Cisco AMP4ep input, it is not allowing us to create one. The save button isn't working, see attached. I tried to create the input, but it is not working either. See the attachment. Splunk Version : 9.0.4.1 Cisco AMP for endpoints input version : 3.0.0 Current input(created manually) ------------------------------------------- [amp4e_events_input] api_host = api.amp.cisco.com api_id = API pin disabled = 0 eai_app_name = search eai_user_name = admin rcvbuf = 1572864 [amp4e_events_input://SPLUNK] api_host = api.amp.cisco.com api_id = api pin index = my_index source = amp4e_events_input://cisco_amp sourcetype = cisco:amp:event stream_name = Splunk_amp4ep   Can anyone help with the correct input? Regards, Nav ... View more

Hello All, I want to create an alert to find certain actions done by users from same Index. Index= myindex sourcetype= mysourcetype action = "session Start" and action=user added Note : From the above actions, the common field are "SessionID"  and user information is only in action=user added.  How to find who started the session based on time?  |table sessionID user src_host  src_ip _time ... View more

Hi All, How to find more than 3 heartbeat failure with failure reason from same host in a day  and put in a table? I am currently using below search, Index="my index" sourcetype="my sourcetype" action="heartbeatfailure"  |bucket _time span=day |stats count by _time host action failure_reason |where count>2  As the failure reason is different i am unable to get result for the same host in  past 24 hrs.  How to get stats count by _time, host, action with failure_reason in same table? ... View more