From the atp-splunk_connector.log you see the following error:
Upload failed with httpcode: , status code: , Reason: [Server is busy]
This can be caused by overloading the Splunk indexer.
This can be resolved on the Splunk side by switching from a single Splunk data collection node to a distributed deployment configuration.
Subscribing will provide email updates when this Article is updated. Login is required to Subscribe
Thanks for your feedback. Let us know if you have additional comments below. (requires login)
This will clear the history and restart the chat.