Hi everyone, I've recently integrated Lansweeper (cloud) data into my Splunk Cloud instance, but over the past few days, I've been encountering some ingestion issues. I used the add-on: https://splunkbase.splunk.com/app/5418 Specifically, the data source intermittently stops sending data to Splunk without any clear pattern. Here's what I've checked so far: My configuration seems fine, and the polling interval is set to 300 seconds. The ingestion behavior appears inconsistent, as seen in the attached image. Based on the type of data Lansweeper generates, I wouldn't expect this inconsistency. While double-checking my configuration, I noticed an error, yet the source still manages to ingest data sporadically at certain hours.   Has anyone experienced similar issues or could provide guidance on how to debug this further? Thanks in advance for your help! LansweeperLansweeper Add-on for SplunkLansweeper Add On For Splunk  ... View more

Hi folks, I'm having a hard time picking the right architecture for setting up a solution to gain high availability of my syslog inputs. My current setup is: - 4 UFs - 2 HFs - Splunk Cloud Syslog is now being ingested on one of the HFs as a network input. I saw that to solve my isssue I could injest my syslog logs on a UF and forward them to my HFs taking advantage of the built-in load balancing of the intermediate forwarders (aka HFs) which would simplify a lot the deployment. On the other hand another seen solution is manually implementing a load balancing machine in front of the HFs to injest the syslog data and manually balance load. Which solution is best suited for a splunk development? IMO 1st one is much more straight forward but I need to validate this is a correct aproach.   Thanks in advanced! ... View more