I can confirm that in the newest version of this app installed on Splunk 7 none of the pre-built panels are working. After reviewing the searches I realized all of the field names in the searches are incorrect. As an example I had to change the pre-built panel called "GCP - Operation Count by User" to the following search to get it to work: index=[your gcp index] sourcetype=google:gcp:pubsub:message data.logName="*activity_log" | rename data.jsonPayload.actor.user as Username | eval Username=if(Username=="", "Unknown", Username) | stats count by Username data.jsonPayload.event_subtype | rename data.jsonPayload.event_subtype as "Event Type" | sort -count | rename count as Count | table Username, "Event Type", Count ... View more