Hello The addon configured for AWS runs form 3 HFs to get the data from SQS queue, however on the SQS, the Messages Available" grows to 999K+ and is not getting cleared. "Messages in Flight" appears to be around 30 Tried to increase the interval to 20 secs on the CloudTrail Input to see if that helps, but it did not. The Queue still grows, dont see any errors on the splunk_ta_aws_cloudtrail_main.log "processing 20 records in s3:logs*/AWSLogs/..json.gz" "fetched 20 records, wrote 20, discarded 0, redirected 0 from s3:logs/AWSLogs/*..json.gz" Any suggestions on how to ensure the Queue is read to clear the Messages Available Thanks ... View more

Hello, I have the below query trying to produce the event and host count for the last hour. The index & sourcetype is listed in the lookup CSV file. However this search does not show an index - sourcetype in the output if it has no data during the last hour. How do I use fillnull or any other method to show the event & host count as 0 when there is no data for that index/sourcetype? | tstats count, dc(host) as hosts where [| inputlookup List.csv ] by index, sourcetype My List.csv is something like below, that lists down the index and sorcetypes. index sourcetype ---------- ---------------- win_idx seclog unx_idx syslog nw_idx lblog db_idx dblog For eg: if index=db_idx sourcetype=dblog count is 0, my current output using the above search is index sourcetype count hosts ---------- ---------------- --------- ---------- win_idx seclog 1500 15 unx_idx syslog 3000 50 nw_idx lblog 1000 25 My expected output is: index sourcetype count hosts ---------- ---------------- --------- ---------- win_idx seclog 1500 15 unx_idx syslog 3000 50 nw_idx lblog 1000 25 db_idx dblog 0 0 Thanks! ... View more