I am trying to integrate this solution into Splunk but I am finding problems. The most relevant as far is the number of retrieved events. I use the official event collector app Radware CWAF Event Collector | Splunkbase It works via API user and I found that the number of events in Splunk doesn't match with the events in cloud console. After opening a support ticket with Radware they told me that the problem is the "pulling rate" for API configuration in my Splunk. I have been trying to find how to configure this "pulling rate" in Splunk but I found nothing. Do you know how to solve this parameter or how do you solve this integration? This is exactly what they told me: Our cloudops team checked to see if there are any differences between the CWAF and the logs that are sent to your SIEM. They found that there is a queue of logs that are waiting to be pulled by your SIEM. Therefore, we do not have any evidence that the issue is with the SIEM infrastructure. For example, if we send 10 events per minute and the SIEM is pulling 5 per minute, this will create a queue of logs. Unfortunately, we cannot support customer-side configuration. It might be more helpful to consult with the support team for the SIEM you are using, as the interval might be the "Pulling Rate."   ... View more

I have read all the posts about "merging fields" and none of the options work for me. I have events where the same value can come in fields with different names. For example, one has the Action in a field called "act" and another the field is "actResult". I tried to use: |eval Action = coalesce("act","actResult") |eval Action = mvappend("act","actResult") But both optiones is generating a field with "act" and "actResult" as value, removing all actual values. And also tried: |rename act as Action actResult as Action But it doesn't work 😞 Any ideas?   ... View more