@msatish - As mentioned by @dionrivera you can use SC4S CEF for parsing.   But if you want to parse the already ingested CEF formatted data in Splunk then you can use this App's custom search command to do that. https://splunkbase.splunk.com/app/7701   ... View more

Hi @msatish  If you open the Developer Console in your browser and navigate to the Network tab, have a look for any resource which load slowly, please let us know which URIs load slowly and that might help us work out what the slowness might be caused by. Please can you also confirm your architecture, resource allocation (CPU/Memory etc), number of SH/IDX etc. 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing ... View more

While rebuilding forwarder database might sometimes help if it becomes corrupted or contains too many orphaned entries, the question worth looking into is how your UFs are deployed and configured. Are you sure they aren't sharing the GUID and hostname? ... View more

Hi @msatish  I’m not familiar with the MOVEit product however I think I found their logging documentation which suggests that this is a windows based service from a company called Progress? If so it looks like the logs are written to the file system at C:\Program Files\MOVEit\Logs however this may vary depending upon the install location.  if this is the case then the best way to onboard these logs will be using a Splunk universal forwarder (UF) configured to monitor the relevant log location and send to your Splunk Cloud stack using the UF forwarding app which you can download from your stack which contains the relevant configuration to send the data.  One you are receiving the data you should verify the relevant props configs to ensure time and event parsing are optimum.  if I have got completely the wrong end of the stick then please provide a link to the product/Vendor that you are using and I will do some more investigation     🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing. ... View more

Here is instructions how todo it https://docs.splunk.com/Documentation/Splunk/9.4.1/Knowledge/Manageknowledgeobjectpermissions#Enable_a_role_other_than_admin_and_power_to_set_permissions_and_share_objects This is not a capability, instead of it, it’s needing a role which have write access to current app where dashboard is and also user must own this dashboard. Only users with admin role can share other people’s KOs. ... View more

@livehybrid Thanks for sharing your insights, this is helpful. ... View more

Hi @msatish  Are you able to test the connectivity from your SingulrAI collector within your organisation to the Splunk instance on the URL/port using something like netcat/curl? Please let me know how you get on and consider adding karma to this or any other answer if it has helped. Regards Will ... View more

@msatish  have you tried this?    ... View more

Hi @kiran_panchavat    Thanks for your response. Which server contains the `passwords.conf` file for Qualys TA (TA-QualysCloudPlatform)? I couldn't find it on the Heavy Forwarder (HF). ... View more

Are you sure that you are using correct entitlement for SCP? If it is then ask help from your Splunk account manager. ... View more