Hello @vnetrebko , I'd like to provide insights into the alternative options you're exploring. Option 1: Splunk App for Google Workspace (App 5556) The Splunk App for Google Workspace (App 5556) is a comprehensive solution designed to collect Google Workspace event data using Google Workspace APIs. It provides CIM-compatible knowledge for use with other Splunk apps. Recent updates include: Version 2.8.0: Added new sourcetypes: gws:reports:chat, gws:reports:mobile, and gws:reports:chrome. Version 2.8.1: Fixed issues with gmail_logs_migrated input. This app allows for structured data collection and is suitable for organizations looking to integrate Google Workspace data into Splunk for analysis and monitoring. Option 2: Integration via GCP BigQuery → Pub/Sub → Splunk For a more scalable and flexible integration, consider using Google Cloud Platform's (GCP) services: BigQuery: Store and analyze large datasets. Pub/Sub: Stream data in real-time. Dataflow: Process and transform data. Splunk HTTP Event Collector (HEC): Ingest data into Splunk. This approach is beneficial for handling high volumes of data and offers greater control over data processing. Google Cloud's Dataflow template facilitates exporting data from Pub/Sub to Splunk, enabling the ingestion of various message types into Splunk. Given your experience with App 5498 and its limitations, Option 2 (GCP BigQuery → Pub/Sub → Splunk) offers a more scalable and flexible solution. While it requires a more complex setup, it provides greater control over data processing and can handle higher data volumes effectively. If this helps you please add it as an solution. ... View more

Hello @maheshnc You can have look at this document and add-on  : https://docs.splunk.com/Documentation/AddOns/released/VMWesxilogs/Install  ... View more

Hello @L_Petch  This seems to be something around parser itself, Curious around this line :  destination(d_splunks_ops)   I believe you have shared only half parser above...? can you please share all details? specially what does this d_splunks_ops stands for and what is inside that ? You can also raise support case on this matter if needed .  ... View more

Hello @cboillot If you are talking about this add-on http://splunkbase.splunk.com/app/2934 it is Splunk supported and you can file support case to triage such request and get the Enhancement ticket filed atleast by same. ... View more

Hello @CyberAar So the main KOs aligned with CIM Add-on are event type, tags , field aliases , Lookups , Data Models. ... View more

Hello @sharpiemarkers  Can you please let me know which version of Add-on you are using ? This is very generic ERROR message BTW we need to have look at Internal logs as well. ... View more

Hello @JykkeDaMan This can be addressed by following below steps: Stop the Deployer First, stop the deployer service to begin the resolution process. Stop the Splunk Service on Each Cluster Node On each cluster node, stop the Splunk service before proceeding. Remove Keystore and Password Files On each cluster node, remove the following files: keystore/default.jks certs/keystore_password.dat Delete Secret Data from Splunk Storage Collections Run the following command on each cluster node to delete the secret data:  curl -k -u username -X DELETE https://<host>:<management-port>/servicesNS/nobody/splunk_app_db_connect/storage/collections/data/secret   Repeat the Process on All Cluster Nodes Perform steps 2 through 4 on all nodes in the cluster to ensure consistency. Start the Splunk Service on All Nodes After completing the above steps on all nodes, start the Splunk service again Also raising support case can make your work more easily in such issues.       ... View more

Hello @Alan_Chan  Follow these quick steps: DNS Resolution: Run nslookup <eventhub-namespace>.servicebus.windows.net on the Heavy Forwarder/Search Head to verify DNS resolution. Connectivity Check: Use ping <eventhub-namespace>.servicebus.windows.net to confirm network access. Firewall Rules: Ensure the public IP of the instance isn’t blocked by Azure Event Hub's IP firewall settings. Permission Check: Verify the Event Hub permissions for the data inputs in question. Endpoint Test: Run wget https://<eventhub-namespace>.servicebus.windows.net/ to check endpoint availability. If the namespace can't be resolved, the Event Hub may have been decommissioned.  ... View more

Hello @new ,  Can you try to directly run search with log file name or an keyword around logs of that custom add-on on Splunk Cloud and check how it goes? ... View more

Hello @new , Can you please share the exact issue you are seeing? l.e., what part of add-on is not working ? are you seeing any ERRORs to check ?  ... View more

Hello @heathramos ,  From the DNS Server you can find possible ERROR logs around issue by going to $SPLUNK_HOME/var/log/splunk and search for file named streamfwd.log please check the ERROR and share here so we can help you with possible things. ... View more

Hello @Dallastek1 , Explanation given by @livehybrid is all correct here based on ERROR messages and screenshot it appears that you are missing required permissions, also make sure that you have given permission as App based and not Delegated one as they are not correct form of permissions. ... View more

Hello @Paul_Szoke , I looked into the app further and it seems it wasn’t developed by Splunk, but by a third-party developer called Rojo Consultancy. Given that, I’m not sure if anyone from Splunk would be able to list it again. The best approach would be to reach out directly to the app developer with a strong use case. You can contact them at hello@rojoconsultancy.com. ... View more

Hello @Nawab @dania_abujuma , Integrating Azure Web Application Firewall (WAF) logs into Splunk can be achieved using the Splunk Add-on for Microsoft Cloud Services. This add-on allows you to collect activity logs, service status, operational messages, Azure audit logs, and Azure resource data from various Microsoft cloud services, including Azure WAF, using Event Hubs, Azure Service Management APIs, and Azure Storage APIs. It provides the necessary inputs and CIM-compatible knowledge to integrate with other Splunk apps, such as Splunk Enterprise Security and the Splunk App for PCI Compliance. Splunkbase+2Splunkbase+2splunk.github.io+2 For more detailed information and installation instructions, you can refer to the official documentation  ... View more

Hello @danielbb , We have this 2 add-on which play around Cisco Meraki: Cisco Meraki Add-on for Splunk : https://splunkbase.splunk.com/app/5580  CCX Add-on for Cisco Meraki: https://splunkbase.splunk.com/app/7365 Cisco Meraki Add-on for Splunk provides comprehensive network observability and security monitoring across your Meraki organizations by collecting data via Cisco Meraki REST APIs and webhooks. It delivers insights into network performance, security, and device health, and includes sample visualizations to help explore the data and create custom dashboards. The add-on also provides Common Information Model (CIM) compatible knowledge to integrate with other Splunk solutions, such as Splunk Enterprise Security and the Splunk App for PCI Compliance. Splunkbase+7Splunkbase+7Splunkbase+7 For a more streamlined and CIM-compliant experience, you might consider the CCX Add-on for Cisco Meraki. This add-on offers enhanced field extraction and CIM compliance for Meraki logs, supporting sourcetypes such as meraki:securityappliances, meraki:devicesavailabilitieschangehistory, and others. It provides additional field extraction and CIM compliance, making it a comprehensive field extraction bundle for Cisco Meraki logs. splunk.github.io+10Splunkbase+10Splunk Docs+10 Both add-ons are compatible with Splunk Enterprise and Splunk Cloud. The Cisco Meraki Add-on for Splunk offers a broader set of features and visualizations, while the CCX Add-on focuses on enhanced CIM compliance and field extraction. Depending on your organization's needs, you can choose the add-on that best fits your requirements. ... View more

Hello @Navneet_Singh @MaureenLynch , As mentioned by @livehybrid This is known bug in add-on so you have to wait till it gets fixed in coming release. However as a temporary solution, after deleting the desired row(s), please make a minor edit to any other cell (e.g., insert a blank space) before saving the file. This forces the app to register the change and update the lookup. ... View more

@deepdiver From all messages present here it appears something around KVStore here you can check KVStore status first using below command: ./splunk show kvstore-status If its up and running then its good otherwise you have to check first Splunkd logs to get the exact ERROR logs. ... View more

Hello @Stanley_F , I would suggest to file an support case as if it looks issue with app. ... View more

This Search can be used to check data correctly during search time: SPL:- index= <index_name> source=<source> host="<host>" sourcetype="XmlWinEventLog" | rex mode=sed field=_raw "s/&lt;/</g" | rex mode=sed field=_raw "s/&gt;/>/g" ... View more

Hello @jwmt24  As of now "Description" field can be used from Custom Fields itself there is no dedicated field for description field. if you are looking to have it dedicatedly supported you have to submit your ideas at IDEAS portal. ... View more

Hello @y0u7 Yes, Splunk App for Salesforce seems to be deprecated as its long time not updated by anyone, regarding its replacement i am afraid if we have any Splunk supported problems. ... View more

Hello @Satyams14 , You can follow-up this documentation : https://repost.aws/articles/ARhXA6njHGRzKEXQ20BKO4lA/how-to-integrate-amazon-guardduty-findings-with-on-premises-splunk to integrate same. Please mark as solution if this helps you.  ... View more

Hello @user487596 You should file support case for such issues. ... View more

Hello @gomitamu , CyberArk TA supports only CyberArk v12. Official support for v14 is not available at this time. However you can use same TA to get data and twick the props if needed, i have seen some people using this TA with v14 and is working fine for them. ... View more