Even I am facing same issue.   response="{"error":{"message":"Response size too large","code":"ResponseSizeError","correlationId":"XXX","innererror": ... View more

Hi Frank, Since I am also expecting an answer to a similar question, please find the details below. When we add a new HEC via inputs.conf in HF, we have a setting restartSplunkd = true in Serverclass associated with HEC app. So whenever we add a new HEC, we need to restart the HF's that is used to collect the HTTP inputs. Can we use restartSplunkd = false while adding a new inputs.conf ? ... View more

I am also looking for a Incident Review feature which allows us to calculate the time took by the Analyst 1 and Analyst 2 for resolvind the ticket in Incident Review ... View more