Known Issues with the Netskope Add-on for Splunk
- For inputs (Events & Alerts Input) with real-time data collection, the Add-on will try to collect data as real-time as possible, but if it lags due to a large amount of data in a specific time range, and lagging time reaches to 1 hour, then data collection will reset back to last 30 seconds and data during that 1 hour will not be collected.
To collect that 1-hour data separately, run this Splunk search query, which will give you the skipped time ranges with input type, starttime, endtime, and sub-types information. Using these, create an input with collection type as historical where you can specify Start Time & End Time.
```index=_internal source="*netskope*" ERROR message=reset_checkpoint | eval input=if(match(source, "netskope.log"), "Events", "Alerts") | table input, starttime, endtime, types```
- The URL List alert action reports `500 – Internal Server Error` error in the log file if the API token v2 is used and a large number of URLs were published in the single API call. Until this is fixed in a future release, use the API v1 token, or make sure that the configured alert action doesn’t push a large number of URLs in a single invocation.
- In the List view of Splunk v8.x.x, integer values are getting rounded off when they reach the maximum integer value: Please note that this is only a view issue from the Splunk end. It is fixed in Splunk v9.x.x
