I want to work on cleaning up data quality issues specific to data received on HEC inputs. Various teams send data into the environments HEC inputs and specify the event metadata. So how could I determine which events came in from the HEC input? I couldn't find ways to match  ... View more

(Asking on behalf of someone else so doing my best to parlay the question) It looks like Android supports W3C Trace Context propagation via its OkHttp and Volley wrappers, which is great. Unfortunately, we don't see this same support in the iOS SDK. We're relying on the traceparent header for sampling decision propagation, so this lack of support means API requests coming from our iOS client often go untraced in APM. Is this a known issue or something that we've missed as a configuration option? We've explored the iOS SDK repository thoroughly but weren't able to figure it out. To clarify, both Android and iOS SDK successfully read the Server-Timing header from an API call's response and associate it with the client-side spans. The issue is that iOS doesn't include the traceparent header on the request, which is what tells the server to trace the operation in the first place. We would expect that to work since it's core to how OpenTelemetry is supposed to work and does work on the web and Android. Standardized context propagation via W3C Trace Context, which includes the sampling decision, is one of the main advantages of using OpenTelemetry. We would need to update all of our backend services with custom logic to understand a novel propagation system, which is a non-starter. ... View more

Shouldn't the "Default value" for this 'Add-on Setup Parameter' get saved in the respective conf file's default file? Or do anything, for that matter? I see it the 'Display initial text' renders when the Configuration UI is loaded but since no value for this is set in the 'default' file there effectively is no value set anywhere - resulting in a broken add-on since it's not "fully configured". Said another way: The default values for Add-on Setup Parameters don't seem to get saved into the respective default conf file created (default/<ta_name>.conf). Conversely, any default values for the Data Input properties do get saved in the proper place in default/inputs.conf . I see some of this info is saved in the <ta_name>_rh_settings but that seems to only handle the setup pages. The result of this missing default config is that when I try to save a new instantiation of the input it won't work because it's missing those critical Add-on Setup Parameters. I'm not AoB expert so maybe I'm doing something wrong here? Cross post: https://splunk-usergroups.slack.com/archives/C04DC8JJ6/p1659404655720859 ... View more