Hi, I would suggest removing the my_third_party_destination value from your defaultGroup property of [tcpout] stanza. If I understood correctly, I guess this setting will make my_third_party_destination the default output for all your inputs. ... View more

Hi, You can use the Splunk Add-on for Amazon Web Services (AWS), available in splunkbase (https://splunkbase.splunk.com/app/1876), for data collection from Amazon S3. Below are some useful links that will help you install and configure the add-on: Installation overview  https://docs.splunk.com/Documentation/AddOns/released/AWS/Distributeddeployment Installation in a single-instance Splunk Enterprise (which I suppose is the case of your on-prem server) https://docs.splunk.com/Documentation/AddOns/released/AWS/Singleinstance Configure S3 inputs https://docs.splunk.com/Documentation/AddOns/released/AWS/S3 Configure SQS-based S3 inputs https://docs.splunk.com/Documentation/AddOns/released/AWS/SQS-basedS3 If you have any other question related to the installation and configuration process feel free to ask. ... View more

Since you already have the Key ID, Secret Key and an IAM role, I guess you can use then to configure the AWS Add-on on your Heavy Forwarder, no problem. I would recommend creating a separate user and role just for security reasons, but if this is not an issue in your environment there is no problem in usnig the existing ones. You just need to make sure the IAM role will have the necessary permissions for each kind of input you plan to add. I recommend you to follow the steps on the following docs: Add an AWS account: https://docs.splunk.com/Documentation/AddOns/released/AWS/Setuptheadd-on#Add_and_manage_AWS_accounts  Add an IAM role: https://docs.splunk.com/Documentation/AddOns/released/AWS/Setuptheadd-on#Add_and_manage_IAM_roles ... View more

Hi, I didn't find any default connection type for MongoDB in my Splunk server that hosts DB Connect, but I know that It is possible to add additional drivers to support other Databases than the defaults. If you need to add an additional driver, you can follow the steps available in this link: https://docs.splunk.com/Documentation/DBX/3.13.0/DeployDBX/Installdatabasedrivers. ... View more

Undesrtood. Now I tried to eval two new fields that would be the percentage of Palo Alto Logins and Total Logins, and them I used the transpose to return rows as columns. Is this the results you expect? index="okta" "outcome.result"=SUCCESS displayMessage="User single sign on to app" | stats dc(actor.alternateId) as "Total Logins" | join [ | search index="okta" "target{}.displayName"="Palo Alto Networks - Prisma Access" "outcome.result"=SUCCESS displayMessage="User single sign on to app" | stats dc(actor.alternateId) as "Total Palo Logins"] | table "Total Palo Logins", "Total Logins" | eval "Total Palo Logins Percentage" = round("Total Palo Logins"*100/"Total Logins", 2) | eval "Total Logins Percentage" = 100 - round("Total Palo Logins"*100/"Total Logins", 2) | table "Total Palo Logins Percentage", "Total Logins Percentage" | transpose Don't know if this was the best way to calculate the percentage, but It seems to be working. ... View more