hi, Did u find the secure solution ?? Regards ... View more

Hi   The client needs to use the same sourcetype, they don't want to change anything from official app, cuz the inputs don't allow to change sourcetype in the configuration, the inputs used are from official app and these assign sourcetype automatically ... View more

HI The  screenshot was an example I installed ofcial app "Mimecast for Splunk" and app folder "TA-mimecast-for-splunk", and I created a custom app called "Mimecast for LiveSOC" and the folder app "TA-mimecast-for-livesoc" , I need to know if the custom app name is correct for force the data to use the configuration from "sourcetype" from custom app and not the oficial app  ... View more

it doesn't work to me, i am using de ofial app Mimecast for Splunk, and i created two custom apps called Mimecast for LiveSOC and Mimecast for neither works what name do you recommend to me using for that? ... View more

hi @richgalloway  ¿Do I have to change the name app or folder name or both?   ... View more

@scelikok last queston, ¿Do you have support documentation where splunk indicate that setting RF and SF equal to indexer count is not a best practice? ... View more

@scelikok thank you, Then,  is it normal that the RF and SF appears like "is Not MeT" untill finish to replicate the buckets?, thus, the master node would show "Search Factor is Met" and " Replication Factor is Met". that is correct? besides, you advise to me apply  RF=2 and SF=3, but the replication Factor cannot be less than Search Factor.     ... View more

Hi @cybermonday could you fix the problem? ... View more

Hi team, someone with de solution , i have updated to last version, 9.1.1, and gess what? it has the same error  Indicator 'ingestion_latency_gap_multiplier' exceeded configured value  Anyon that some solution?   ... View more

IF you search generate 2 results, in the "once" options , yo will receive one alert with 2 results, but if is "For each result", you will receive 2 alerts, one for each result     ... View more

Thanks for u help, Do u know I how integrate through "trasnforms.com"  by rules? ... View more

Hi, there are four event types , I am gonna share these examples,  <134>Nov 24 14:09:52 NSX-edge-7-0 loadbalancer[2196]: [default]: 192.168.0.12:53184 [24/Nov/2022:14:09:52.006] CMP_RP_virtualserver CMP_RP_Pool/cmp_rp1_member 1/0/12 3132 -- 4/4/3/3/0 0/0 <28>Nov 24 14:09:00 NSX-edge-7-0 config[]: [default]: WARN :: C_UTILS :: File /var/db/networkmonitor/monitor_status.dat not exist <30>Nov 24 14:09:00 NSX-edge-7-0 config[]: [default]: INFO :: loadbalancer stats :: member stats.pool:CMP_RP_Pool,member:cmp_rp2_member,ip:172.xx.xx.x,port:xxx,status:1,vip:CMP_RP_virtualserver <4>Nov 24 14:09:56 NSX-edge-7-0 firewall[]: [default]: ACCEPT_131091IN= OUT=vNic_0 src=10.2.xx.xx DST=172.xx.xx.xx LEN=62 TOS=0x00 PREC=0x00 TTL=63 ID=31370 DF PROTO=UDP SPT=xx818 DPT=xx LEN=xx   As you can see,  before [default], there are differents values can be  a differentiator. loadbalancer[2196] config[] firewall[] could I use that for doing rules?     ... View more

thanks for u help.. So, if the value in FIELDA no always are digits? ... View more