You can go to Searches, Reports, and Alerts, then set the App to be Splunk Security Essentials. If you set the Owner to All, you can then see all of the included Searches in the app. If one of them is scheduled, you can set its time range and schedule, so that it will onboard data from long ago in a single swoop. Did you do anything in the app interface to activate the "onboarding background search?" ... View more

Hi @inventsekar ..I tried the solution which u provided...It didnot work is there any other solution ... View more