For Option # 1 " If you want to use UF then you can directly send data to Splunk cloud ...",  what config exactly do we need to put in the outputs.conf of the UF to make it fwd to Cloud instance ?    All  we have in the URL/hostname of the managed Search head instance  .  Are you saying we need to put this hostname in the outputs.conf and Splunk will do the rest and as in sending the data from SH to its indexer tier ? ... View more

Hi @FraserC1, if the search returns all the group_servers you haven't any problem and don't need any add-on to you search, you have all the resuolts. My solution is to solve the situation when some group_server is missing (and I understood that this is your problem, if I'm wrong, sorry!), but to do this you have to know the exact list of group_servers to monitor. Ciao. Giuseppe ... View more

Got it in one! Showing the results exactly as I want them. Thanks for your help. ... View more

The earliest keyword applies only to the _time field.  To filter on create_time, use a separate command after converting the field to epoch form. index="automox" sourcetype="automox:software" severity=critical installed=true os_name="Server*" earliest=-1d | eval created = strptime(create_time, "%Y-%m-%dT%H:%M:%S%z") | where created > relative_time(now(), "-1d") | dedup server_name name ... View more

Hi @isoutamo , Thanks for this, that's given me exactly what I was looking for! ... View more

Hi @Nisha18789 ,   Yup this is exactly what I was looking for. Can't thank you enough for taking the time to help me with this!   Very much appreciated. ... View more

The data models are accelerated and they do return events. ... View more

It is telling you the problem: it cannot connect to the server. Many admin things in Splunk Cloud (such as installing apps, but maybe that is looser now) require you to open a support ticket to get their guys to do the admin. I would definitely open a support ticket and see what they say. ... View more

First of all, you need to be running the AWS App 5.2 or later and you need to enable the billing feature under the "Configure" setting on the AWS App. Once complete, then make sure to update the Backfill / acceleration for the data model (Detailed Billing CUR). It defaults to last 12 hours, change it to last year if you want it to go back. Splunk App for AWS -> Configure -> Select billing report type Billing (Cost and Usage Report) ... View more

Thanks for the reply. Looking at the documentation it does seem to specifiy the data collection node needs to be a separate server however? ... View more

Hey, thank you for your response. I am using the Sophos Add-On for Splunk. https://splunkbase.splunk.com/app/4096/ And it does seem to say it is CIM compliant according to the updates on v1.0.1. But I don't get any results when performing your searches so something is going wrong somewhere or it is not CIM compliant as it states. I suppose I will have to make the data CIM compliant as you suggested. If you have any ideas on how to do this that would be excellent, if not I will just look into it. Thanks again! ... View more

I'm going to answer this for anyone in the future that has this issue, below is the recommendation from Splunk support on how to fix this issue. I first disabled the aws_inspector input then made the changes and re-enabled it. This sorted my issue and I was able to get inspector data in to Splunk. The recommendation is to backup and delete the file labeled internals inside the checkpoint directory at: /$SPLUNK_HOME/var/lib/splunk/modinputs/aws_inspector The issue is a checkpoint file has been created which contains nothing which is trying to be read. Restart splunkd after performing this task. ... View more

You could go with your idea of generating a test file, say every 1 hour and monitoring it or you can also use add-ons like https://splunkbase.splunk.com/app/2776/ ... View more

Hi, thanks for your response! This looks interesting I will give it a shot. So there is no way for it query the DNS server instead of using a csv file? ... View more

You need the Cisco Security Suite app to support the Cisco ASA. https://splunkbase.splunk.com/app/525 (Sorry I posted my answer in the wrong place) ... View more

I documented a fix for that on the wiki for the Home Monitor App on Github: wiki help Let me know if that works, otherwise I'll dig around and see how I can help you out. ... View more

Yes there is a good documentation on rtorder command https://docs.splunk.com/Documentation/Splunk/7.0.2/SearchReference/Rtorder Accept the answer if it solves your problem! ... View more