I'm new to this! Our custom app stopped working on Splunk Cloud and was told by support to change an xml file below from app.html to search.html because of a Cloud change. However, when I go to reupload the same app, I get the error that app validation failed: App does not support search head cluster environments. It passes all the vetting just gives that error at the end. What could it possibly be looking for? Again, new to this so can't find the answer in google.. 🐵   <?xml version="1.0"?> <view template="pages/search.html" type="html" isDashboard="False"> <label>Search</label> </view>   ... View more

Starting our journey into Splunk and need some help. I am trying to send and alert when a new version of antivirus is installed on our machines. I am monitoring the application windows event log, so it would be something like grab the version from 20 minutes ago in the logs and if different than current version send the alert. "Message=Windows Installer installed the product. Product Name: Antivirus Software. Product Version: 1.0.0.000.1. Product Language: 001. Manufacturer: Antivirus. Installation success or error status: 0" Any ideas on how to start this search? ... View more