Hi, I've installed the TrackMe app in my Splunk Cloud environment.  It's automatically discovered my environment, including indexes and sourcetypes.   I want to monitor most sources by index, not sourcetype.  I've configured the index to be monitored, but all the additional sourcetypes for that index still remain.  Do I need to click on each of these and delete them?  Is there another way to do this?  It's a fair amount of sourcetypes.   ... View more

hi all, Has anyone able to get the upgrade ufw app for windows to work?  I get a message in the logs saying it started, but nothing else, and I don't see any other logs.  My MSI is in the \static directory, and I've tried the following as variables: App is:  https://splunkbase.splunk.com/app/5003/ set "UPGRADEVER=8.0.4" set "UPGRADEFILE=static\splunkforwarder-8.0.4-767223ac207f-x64-release.msi" also this:set "UPGRADEVER=8.0.4" set "UPGRADEFILE=splunkforwarder-8.0.4-767223ac207f-x64-release.msi" The logs show that the job ran, but nothing has changed.  No further details in any other logs.   ... View more

I've created an alert with a throttle, but it appears that the actions are not honoring the throttle. Does the action run regardless of the throttle? ... View more

has anyone had issues with the whois app command from centralops? https://splunkbase.splunk.com/app/3506/ - the dashboard form works fine, but when I enter the spl command - | centralopswhois output=fields limit=2 google.com it returns nothing. I'm running this from a Splunk cloud instance. ... View more