Is it possible to ingest Meet logs with this app? That is a totally different table that Chat in BigQuery. ... View more

Good morning, I am trying to use the OWL Diode Sender Add-on, the issue I am running into is the ingest keeps stopping. It works again after I restart it.   More details... I have a staged HFW (running the latest 9.4.x release) that is ONLY sending data to to OWL, currently UPD. The problem is just that the data feed keeps stopping, then it won't start until I restart the heavy forwarder again.  I am currently assuming Splunk probably thinks the buffers are full or something so it "pauses indexing events." I login to the HFW and the status shows green with no errors. I am not seeing any interesting error or fatal logs. I know the issue is with Splunk because the output logs show 0kps.  This Splunk HFW is also acting as a deployment server  and has https turned on.  It has a perpetual (no data ingest) license and is ONLY sending data out to the OWL.    Any suggestions would be greatly appreciated.   [indexAndForward] index=false [tcpout] indexAndForward = false defaultGroup = syslog:diode-syslog-udp #defaultGroup = syslog:diode-syslog-tcp forwardedindex.2.whitelist = (_audit|_internal|_configtracker|_dsclient|_dsphonehome|_dsappevent) forwardedindex.filter.disable = true [syslog:diode-syslog-tcp] disabled = false server = 10.0.1.100:5004 maxEventSize=512000 # PRO: Always works # CON: limited to MTU size [syslog:diode-syslog-udp] disabled = false server = 10.0.1.100:7504 maxEventSize=512000   ... View more

Hello, Is this app going to be upgraded for Splunk Enterprise 10? Makes it impossible to install in Splunk cloud otherwise.  Thanks,   ... View more

This is a comment rather than a question.  Please add the ability to ingest audit logs in to the Dynatrace add-on.  ... View more

The current Netscaler guidance is that logs should be exported via HEC. However, it seems like the app doesn't have a sourcetype for HEC. Any guidance on that? https://docs.netscaler.com/en-us/citrix-adc/current-release/observability/auditlogs-splunk-integration.html ... View more

Hello all   Is the Nutanix TA (version 2.5.0) compatible with Splunk 9.3.4+? It is listed as such on the splunk base (https://splunkbase.splunk.com/app/3103) but when I attempted to upgrade Unable to initialize modular input "abc" defined in the app "TA-nutanix": Introspecting scheme=nutanix_health: script running failed (PID 2607550 exited with code 1)..   ... View more

Hello, Does anyone know when this app will become cloud compliant? ... View more

Hello, Does anyone know if there are any plans for this app to become compatible with recent versions of Splunk? It claims to be compatible with 9.4 but it is running python 2...    ... View more

Hello all, I am wondering if anyone has run into an issue where they receive a "500 error" on some large reports (small reports work fine)? The only feedback I got from the cSAM admin was to add a time out value in Microsoft PowerQuery, doesn't quite seem to relate to CURL though.     personal_access_token = "MyRealToken", request_timeout_in_minutes = 10, // Specify your timeout value here data = Table.FromRecords( Json.Document( Web.Contents( csam_api_endpoint_url, [ Headers = [ #"Authorization"="Bearer " & personal_access_token, #"Content-Type" = "application/json" ], Timeout = #duration(0, 0, request_timeout_in_minutes, 0) ] ) ) ) in data   ... View more

Hello all, Just wondering if anyone else is removed index time extractions for the Cisco DNA Center Add-on (6668). I don't like that it needlessly indexes fields then resolved the duplicate-field issue by disabling KV_MODE. I was thinking of adding something like this to the app props.conf but I am still looking better options.     INDEXED_EXTRACTIONS =  KV_MODE=JSON SHOULD_LINEMERGE=false LINE_BREAKER=([\r\n\[\]\,]+\s*)([\{]) ... View more

Hello all, In our environment, the UiPath team doesn't seem to know how to expect the export expecting in the default inputs.conf (C:\uipath_logs). Is there any documentation that might help them? ... View more

Hello all, SynApp: 3.0.3 OS: RHEL8 FIPS Splunk 9.0.x I configured this app and changed the index IPs in the local inputs.conf but it isn't working. Obviously there are a lot of things that could be wrong but I am really not seeing any app logging. Is there anyway to configure that? Does this app have a FIPS incompatibility?  The only thing I am finding are these logs in splunkd.log: ERROR ExecProcessor [1044046 ExecProcessor] - message from "/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/Synack/bin/assessment_data.py" obj, end = self.raw_decode(s, idx=_w(s, 0).end()) ERROR ExecProcessor [1044046 ExecProcessor] - message from "/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/Synack/bin/vuln_data.py" json.decoder.JSONDecodeError: Expecting value: line 1 column 1 (char 0) ... View more

Hello, Has anyone been able to ingest Certificate Transparency logs (via Certificate Transparency Log add-on for Splunk or any other app) on Splunk Enterprise version 9? ... View more

Has anyone setup CIM parsing for the Akamai SIEM TA? I am assuming these events should be going to the Alerts data model, but there is almost no parsing in the app.  https://splunkbase.splunk.com/app/4310/ ... View more