The problem was that the index was not created on the master. When the index created on the master server was pushed to all indexers, the OTX data was pulled and written to the index. Thank you for your help and feedback. ... View more

@livehybrid  Thank you for feedback. Yes, each result is dated today. For example: "modified":"2025-04-08T10:52:59.705000", "created":"2025-04-08T10:51:32.650000",   And, definition of Backfill days: 30 ... View more

@livehybrid  Additionally, log samples: 2025-04-08 13:56:19,927 INFO pid=426325 tid=MainThread file=base_modinput.py:log_info:295 | Retrieving subscribed pulses since: 2025-04-08 10:54:39.948582 2025-04-08 13:56:19,927 INFO pid=426325 tid=MainThread file=setup_util.py:log_info:117 | Proxy is not enabled! 2025-04-08 13:56:20,146 INFO pid=426325 tid=MainThread file=base_modinput.py:log_info:295 | Completed polling. Logged 0 pulses and 0 indicators. 2025-04-08 13:58:00,005 INFO pid=426392 tid=MainThread file=setup_util.py:log_info:117 | Log level is not set, use default INFO 2025-04-08 13:58:00,006 INFO pid=426392 tid=MainThread file=splunk_rest_client.py:_request_handler:99 | Use HTTP connection pooling 2025-04-08 13:58:00,038 INFO pid=426392 tid=MainThread file=base_modinput.py:log_info:295 | Retrieving subscribed pulses since: 2025-04-08 10:56:19.897881 2025-04-08 13:58:00,039 INFO pid=426392 tid=MainThread file=setup_util.py:log_info:117 | Proxy is not enabled! 2025-04-08 13:58:00,268 INFO pid=426392 tid=MainThread file=base_modinput.py:log_info:295 | Completed polling. Logged 0 pulses and 0 indicators. ... View more

Hi @livehybrid  curl request returns results but no data can be pulled to the OTX index. Additionally, according to your experience, which server would be more beneficial to install the OTX application on the Splunk Cluster side? (Ex: master, deploy, forwarder, indexer, etc.) ... View more

@kiran_panchavat Thank you for your feedback. Yes, it was created. When internal logs are examined, the following logs are taken from the $SPLUNK_HOME/var/log/splunk/ta_otx_otx.log file. Is it unable to pull data or could there be a different situation? 2025-04-08 15:08:38,918 INFO pid=433448 tid=MainThread file=base_modinput.py:log_info:295 | Completed polling. Logged 0 pulses and 0 indicators. ... View more