Totally agree. ... View more

To bad it didn't help. May suggest to remove the continous input totally and create a new one because it looks like the date setting is stuck there somewhere. ... View more

Hi! I had a similar problem. Looks like there is some bug in the date features. The API only supports requests up to 7 days back, and it looks like the app overrides the date settings from the continous monitor start time setting, replacing the start date with the date from the latest indexed events. What i did: 1. Disabled the continous input temporarily. 2. Created a new input for a "index once" job. (Don't use the same input as you did for the continous monitor) 3. Set interval to "-1" and Window size and Delay throttle so you don't exceed the limitations in the API. (2000 messages or so per query) 4. Index the last 7 days worth of data using the newly created "index once" input- 5. Wait for the job to complete and catch up with today's date. 6. Disable the "index once" input. 7. Re enable the continous input leaving the "Start date/time" blank. 8. This did the trick for me Hope it helps ... View more

Hi! Had the same issues, but i played around with the settings and found something that worked for me: Interval: 300 seconds Query windows size: 30 minutes Delay throttle: 32 minutes Probably not optimal settings, but at least it works better than the default values 🙂 ... View more

Tagging this as i'm having a similar use case 🙂 ... View more

Confirmed that we also got hands on the intermediate version from Splunk. Installed it and it worked like magic! ... View more

Hi! Tagging this as i have the same problem. Splunk v 6.6.3 and app version 2.0.3. Azure_AD, Exchange and Sharepoint inputs are getting this error, but the Operational Messages is still functional. Looking to see if anyone have a good permanent fix to this. , ... View more