AMP for Endpoints Event Inputs App

[plao]

Hi

I was able to install and configure the AMP for Endpoints Event Inputs App for all Event Types and Groups. However, not sure why, when I do a search in Splunk, index=* sourcetype="cisco:amp:event", I can only see AMP4E events like from 8 hours ago, I am not able to see any of the recent AMP4E events

[plao]

Now all of a sudden, starting around 3:19pm, I started seeing some AMP4E events in Splunk

But they are coming in very slowly (not anything close to real time at all)