Hello partners I request your kind support as I intend to activate the Linux ESCU correlations, however these do not work well because the datamodels are not complete, I know they are necessary, but my observation is that the Linux events do not contain all the values ​​necessary to fill the datamodel. So my question to the community is the following: What audit, messages or syslog rules must be active for the correct collection of events? ... View more

Hi friends.   I've followed de path to use UniversarForwarder app from my splunk cloud enviromen. But i have the next message: The TCP output processor has paused the data flow. Forwarding to host_dest=inputs1.XXXX.splunkcloud.com inside output group splunkcloud_ from host_src=YYYYYY has been blocked for blocked_seconds=10. This can stall the data flow towards indexing and other network outputs. Review the receiving system's health in the Splunk Monitoring Console. It is probably not accepting data. Learn more.   I've tested the communications to splunk cloud   splunkcloud.com:9997 splunkcloud.com:8000 splunkcloud.com:8089   And all are OK. My heavy forwarder is now skipping data. Is there something else I clould check out?     ... View more