Hi Please advise how we can improve the performance the gap is now 36 hours   ... View more

thanks , it worked for me  how I can improve the performance , I have a 24H gap now the HF is running this integration only  [mscs_azure_event_hub://eventhub] account = splunk consumer_group = $Default event_hub_name = eventhub event_hub_namespace = eventhub.servicebus.windows.net index = amdocsazureadlogs interval = 30 max_batch_size = 2000 max_wait_time = 10 sourcetype = mscs:azure:eventhub use_amqp_over_websocket = 1 disabled = 0 ... View more

02:05:19 2023-01-22 08:13:19 2023-01-22 06:08:00.000 azure:eventhub 02:05:41 2023-01-22 08:08:41 2023-01-22 06:03:00.000 azure:eventhub 02:05:41 2023-01-22 08:08:41 2023-01-22 06:03:00.000 azure:eventhub 02:05:51 2023-01-22 08:08:51 2023-01-22 06:03:00.000 azure:eventhub 02:05:51 2023-01-22 08:08:51 2023-01-22 06:03:00.000 azure:eventhub 02:06:09 2023-01-22 08:09:09 2023-01-22 06:03:00.000 azure:eventhub 02:06:09 2023-01-22 08:09:09 2023-01-22 06:03:00.000 azure:eventhub 02:06:39 2023-01-22 08:20:39 2023-01-22 06:14:00.000 azure:eventhub 02:07:08 2023-01-22 08:13:08 2023-01-22 06:06:00.000 azure:eventhub         ... View more

How I can define that the lookup doesn't have a header  and the first line is a value  ? ... View more

the question is how I mark // is part of the path  I tried to \/\/ but it didn't work  How to mark the specials characters  ... View more

Thanks a lot , I was able to filter the data  1 more question , how I can define monitoring stanza for s3://aws-controltower-logs-272341124329 ..... I have tested with  [source::.../aws-controltower-logs-272341124329*/.../*.json.gz] but I want to add s3:// ... View more

we are on Splunk Enterprise on premise is there an option to exclude those events in Splunk Add-on for AWS also ? ... View more

Hi I already tried it before and it still shows 0 files  ... View more

C:\Users\issplunk>dir \\ntnet\filestore1\information_security$\ACSC_Websense_Large_Web_Traffic_Exclusion_List\*.csv Volume in drive \\ntnet\filestore1 is SCCM Content Volume Serial Number is 1EFA-6F4C Directory of \\ntnet\filestore1\information_security$\ACSC_Websense_Large_Web_Traffic_Exclusion_List 09/12/2022 04:01 PM 5,453 Websense_Lare_Web_Traffic_Exclusion_August_2022.csv 09/13/2022 03:23 PM 5,458 Websense_Lare_Web_Traffic_Exclusion_082022.csv 2 File(s) 10,911 bytes 0 Dir(s) 211,867,983,872 bytes free C:\Users\issplunk> ... View more

[monitor://\\ntnet\filestore1\information_security$\ACSC_Websense_Large_Web_Traffic_Exclusion_List\*.csv] disabled = 0 index = websense_large_web_traffic sourcetype = csv crcSalt = <SOURCE> initCrcLength = 512   still I see 0 in the heavy forwarder      ... View more

 just notices that if I add data manually from the HF itself the data is not indexed also   what can be the reason  ?  ... View more

the data is not indexed to the index  also I don't see any events in the internal indexes  what can be the reason HF doesn't recognize filers  ? I copied the same file to my local and was able to index manually   ... View more

the data is not indexed  I also don't see any activities in index=_*  and the issue that I see that the HF see 0 files under the path  ... View more

Do you know if its planned to use lower permissions  ? ... View more