Another fix to try is as follows: Find your distsearch.conf and then find the stanza that has default = true in it. In that stanza, make sure localhost:localhost is listed in the setting below     servers =       For example, it was like this before: distributedSearch:testgroup1 default = true servers = somehostname.company.com Once you find that stanza, add localhost to make it look like this (and it's literal in that it's simply localhost:localhost) distributedSearch:testgroup1 default = true servers = somehostname.company.com, localhost:localhost Restart the DS and from the internal thread within a few minutes/hours the clients should start to populate again   ... View more

Solution worked for me ... View more

TYVM for the reply and info ... View more

There should be a sequence_number field in the config logs that can be correlated with the other logs of the same number to list the changes made to firewall rules ... View more

Can you please share how you fixed the issue? Thx ... View more

Intune logs can be sent to an Event Hub - https://learn.microsoft.com/en-us/mem/intune/fundamentals/review-logs-using-azure-monitor - and then Splunk Add-on for Microsoft Cloud Services to ingest the Intune events into Splunk ... View more

As with Splunk, a million ways to do it so something basic like the following:   index=<your_index> sourcetype=<your_sourcetype> source=<your_datasource> earliest=-15m (or another time range) | stats sum(<your_volume_field> such as bytes_sent) as data_volume | eval threshold=1000000 # Set desired threshold for data volume | eval is_reduced_volume = if(data_volume < threshold, "Yes", "No") Can get a little more deeper with ML: index=<your_index> sourcetype=<your_sourcetype> source=<your_datasource> earliest=-15m | timechart span=1m sum(<your_volume_field>) as data_volume | fit MLTK_AnomalyScore(data_volume) as anomaly_score | eval threshold=0.9 # Set desired anomaly score threshold | eval is_anomaly = if(anomaly_score > threshold, "Yes", "No") And Lantern may have something they can leverage as well: https://lantern.splunk.com/Splunk_Platform/Use_Cases/Use_Cases_Security/Forensics/Crea[…]work_activity/Hosts_logging_more_or_less_data_than_expected ... View more