Hi community, I'm running into a permissions/visibility issue (I don't know) with an index created for receiving data via HTTP Event Collector (HEC) in Splunk Cloud. Context: I have a custom index: rapid7 Data is being successfully ingested via a Python script using the /services/collector/event endpoint The script defines index: rapid7 and sourcetype: rapid7:assets I can search the data using: index=rapid7 and get results. I can also confirm the sourcetype: index=rapid7 | stats count by sourcetype Problem: I am trying to add rapid7 to my role’s default search indexes, but when I go to: Settings → Roles → admin → Edit → Indexes searched by default The index rapid7 appear blank, I don't know that this is the all problem.  What I’ve verified: The index exists and receives data The data is visible in Search & Reporting if I explicitly specify index=rapid7 I am an admin user I confirmed the index is created (visible under Settings → Indexes) My Questions: What could cause an index to not appear in the "Indexes searched by default" list under role settings? Could this be related to the app context of the index (e.g., if created under http_event_collector)? Is there a way in Splunk Cloud to globally share an index created via HEC so it appears in role configuration menus? I want to be able to search sourcetype="rapid7:assets" without explicitly specifying my index=rapid7, by including it in my role's default search indexes. Any advice, experience or support links would be appreciated! Thanks! ... View more

Hello Splunk Community, I have installed the Cloudflare for Splunk app on Splunk Cloud and have successfully configured Logpush to send logs from Cloudflare to Splunk following the official instructions. I have verified that the logs are arriving correctly in Splunk using search queries like: https://splunkbase.splunk.com/app/4501 index=cloudflare | head 10 I can see the logs in the search results, confirming that data ingestion is working. However, when I open the Cloudflare for Splunk dashboards, they are empty, showing "No results found". I've checked the following topics. Checked Data Arrival - Logs are arriving correctly in Splunk (index=cloudflare contains data). Confirmed Sourcetype - The logs are being assigned the expected sourcetype (cloudflare:access, cloudflare:network, etc.). Verified Time Range - Made sure the dashboards are set to a broad time range (Last 24 hours or All Time). Checked Permissions - Ensured that the user running the dashboards has access to the cloudflare index. Examined Dashboard Searches - Manually ran the searches used in the Cloudflare dashboards, but they returned no results. Questions: Has anyone faced this issue before? Are there any known fixes or configuration adjustments required for the Cloudflare for Splunk dashboards to populate correctly? Do I need to manually adjust field extractions or event types for the dashboards to work? I appreciate any guidance or recommendations you can provide. Thanks in advance for your help! Best regards, ... View more