Hi @KJ10  Thanks for your response, ultimately its going to be hard to identify the best approach to this without having the code, but I would suggest determining how its currently written and then checking out the best-practices for the approach taken. Typically there are 3 ways to create a Splunk app: Splunk Add-on builder UCC Framework (my preference) Custom Python  I'd start by looking at the common code between the 5 existing modules and find where you can put a loop to loop over the the different endpoint (presumably?) that you need to query so that you combine the inputs. Be sure to update the source/sourcetype accordingly for each of the iterations so that your data doesnt end up in one big source/sourcetype and hard to separate between the 5 types. If you're able to share the code on here (anonymised if required) then I might be able to tailor the help but please let me know how you get on and consider adding karma to this or any other answer if it has helped. Regards Will  ... View more

Hi @KJ10 , could you share your inputs.conf file? anyway, in general, the option index=<your_index> in inputs.conf, if the index is really existent, shouldn't have any issue. Didi you checked if the index is really existent and if you gave the correct grants to it? Anyway, if you restore the original index name in inputs.conf, and restart Splunk on the Forwarder, logs should arrive to the original index; did you restarted the UF after restored the original index? Are you using a Deployment Server to deploy configurations on UF or did you manually modified them? Ciao. Giuseppe ... View more

Hi @marnall ,  We are using Splunk python sdk in our App to configured custom data inputs. Please check below link for reference. https://dev.splunk.com/enterprise/docs/devtools/python/sdk-python/howtousesplunkpython/howtocreatemodpy/ Issue here is during creation or editing data input Stream_event function is called and it called after specific interval of time as well like each 15 min. We need to identify in Stream_event function from where it gets called, so accordingly we have 2 different algorithm to execute. ... View more

Hi @KJ10 , I’m a Community Moderator in the Splunk Community. This question was posted 3 years ago, so it might not get the attention you need for your question to be answered. We recommend that you post a new question so that your issue can get the  visibility it deserves. To increase your chances of getting help from the community, follow these guidelines in the Splunk Answers User Manual when creating your post. Thank you!  ... View more

Hi @thellmann , We have our hosted apps on Splunk Enterprise and vetting is also completed and passed successfully. How can I unit test that app  over splunk cloud without license or using any Dev license before release. Any workaround for this? ... View more

I am unable to see uploaded tab on Free trial Splunk cloud instance ... View more