Hi team,
I'm trying to enable logoff information listed here:
https://uberagent.com/documentation/splunk-events-and-source-types/#user-logoff
Splunk doesn't seem to have any of this data captured by default, searching Sourcetype="uberAgent:Logoff:LogoffPerformance" or similar logoff data doesn't return any results.
I also can't find a UA Metric, timr or 'on demand' to put in the .conf file to enable it.
Am I missing a step or doing something wrong?
Many thanks
Andy