Yes, i'm also facing similar issue. not resolved. ... View more

Hi, Have integrate logs to Splunk via S3 SQS successful. Have asked CM team dumps the logs to client S3 bucket from there on , we are pulling them to Splunk. thank you all your inputs. ... View more

got it thank you. ... View more

I'm trying understand the below query to implement. what would be the expected result . Any idea about this query. https://lantern.splunk.com/Splunk_Platform/UCE/Security/Threat_Hunting/Protecting_a_Salesforce_cloud... ROWS_PROCESSED>0 EVENT_TYPE=API OR EVENT_TYPE=BulkAPI OR EVENT_TYPE=RestAPI |lookup lookup_sfdc_usernames USER_ID |bucket _time span=1d |stats sum(ROWS_PROCESSED) AS rows BY _time Username |stats count AS num_data_samples max(eval(if(_time >= relative_time(maxtime, "-1d@d"), 'rows',null))) AS rows avg(eval(if(_time<relative_time(maxtime,"-1d@d"),'rows',null))) AS avg stdev(eval(if(_time<relative_time(maxtime,"-1d@d"),'rows',null))) AS stdev BY Username |eval lowerBound=(avg-stdev*2), upperBound=(avg+stdev*2) |where 'rows' > upperBound AND num_data_samples >=7   ... View more

Yes, thank you,... we have integrated S3 bucket and from there we are onboarding the logs. ... View more

Basically - How to get the below information as this critical for us to know it on daily basis as service provider. 1.How much data ingested to Splunk on daily basis. (We have query for that). 2.How much data is getting stored on active searchable storage.(Assuming the same should be reflecting in the active searchable storage) on daily basis. 3.How much data has been moved from searchable active(Online Storage) to Active Archive(Offline Storage) on daily basis. 4.How much data has been purged/deleted from Active Archive(Offline Storage) daily. ... View more

Hi, I could get the results when I run the command. My observation about the lookup file  between SH and ES on SH is , the .CSV extension is missing.once added it's running. I'm trying understand the below query to implement. Firstly, the description provided in   the usecase is not clearly understood . I got this usecase from the splunk SF content search. Anyone has idea about this query. https://lantern.splunk.com/Splunk_Platform/UCE/Security/Threat_Hunting/Protecting_a_Salesforce_cloud_deployment/Spike_in_exported_records_from_Salesforce_cloud ROWS_PROCESSED>0 EVENT_TYPE=API OR EVENT_TYPE=BulkAPI OR EVENT_TYPE=RestAPI |lookup lookup_sfdc_usernames USER_ID |bucket _time span=1d |stats sum(ROWS_PROCESSED) AS rows BY _time Username |stats count AS num_data_samples max(eval(if(_time >= relative_time(maxtime, "-1d@d"), 'rows',null))) AS rows avg(eval(if(_time<relative_time(maxtime,"-1d@d"),'rows',null))) AS avg stdev(eval(if(_time<relative_time(maxtime,"-1d@d"),'rows',null))) AS stdev BY Username |eval lowerBound=(avg-stdev*2), upperBound=(avg+stdev*2) |where 'rows' > upperBound AND num_data_samples >=7       ... View more

Addon is also installed. ... View more

Hi  Thank you for the response. On SH, we are not getting this error. We getting these errors on ES and the app is available there and it's  accessible globally. We are running query specific to Salesforce index only.   ... View more

Thank you let me go thru the documentation. ... View more

Thank you for the response. You mean to say the daily ingested  data is compressed whenever it is coming to online active storage due to the reason , I'm only noticing a difference of ~60GB on day 2 day basis.is my understanding correct. ... View more

Thank you for the content.  Happy new year!!! ... View more

Thank you, sir, for the inputs share. Will come back if something needed. ... View more