Hello @deangoris, The Splunk packaging toolkit will also work in the similar fashion. The packages created using the toolkit should not have the local folder within it. Otherwise it'll fail on the UI itself. The best way to deal with this situation is to have a Barebone app created from the UI and have all the KOs migrated to the custom private app. This way it helps modifying the objects from UI in future as well.   Thanks, Tejas.   --- If the above solution helps, an upvote is appreciated..!!  ... View more

Resaving the inputs worked for me. ... View more

Hi, I would like to pick this up again. We're running on Splunk 8.1 now with the IIS add-on en ms:iis:auto source type working good for some time already. Recently we added the add-on for Microsoft Cloud Services and try to read the IIS logfiles from there as well. It looks like ms:iis:auto isn't extracting the fields. Is this still a problem for these kind of modular inputs or should this be perfectly possible? ... View more

Hi, Did you looked into MLTK new algorithm StateSpaceforecast which supports multivariate? Checkout the blog below for more information:https://www.splunk.com/blog/2019/03/20/what-s-new-in-the-splunk-machine-learning-toolkit-4-2.html Also, we have now new alerts for Machine learning which can be used in your usecase. Checkout the documentation on statespace forecast here : https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#StateSpaceForecast Thanks, ... View more

Do you mean to say to use the coalesce in place of the fieldalias definition? ... View more

You'll probably be most successful by following the instructions in the app's docs (linked to in the apps' details page) in regards to where to deploy the app to. I would keep the config you need in the local folder of the MSSQL add on. Start with it there and you may build confidence to move it's config elsewhere later...but I wouldn't start that way as it can be more confusing. Also, the design of a local folder within that app is specifically meant to help with the config management thereby allowing a 'default' folder to be overwritten during updates (but not blowing away your local folder). Make sense? ... View more