First of all, the lookup table rebuilder within the Sharepoint App on Splunk stops at
Lookup - 'SPWeb' and I have an error in my messages:
Unable to initialize modular input 'sp13inventory' defined inside the app 'TA_Microsoft-Sharepoint'. Unable to locate suitable script for introspection.
On a restart of Splunk on the Indexer as well, I am getting an error:
while parsing '/opt/etc/apps/Splunk_for_Sharepoint/default/data/ui/views/usage/usage_sites.xml': not well-formed (invalid token): Line 39, column 62.
Basically, my Sharepoint setup needs a little help - and I'm not sure where to look first. SQL and Powershell apps are installed and GPOs setup. Also - I've put an inputs.conf file within the Sharepoint app on the Sharepoint server, but do I need an index.conf file on my indexer specifically for Sharepoint - and what should this contain?
Thanks for any help!! 🙂
If you are not sure where to look first, as a start, please make sure you have followed the instructions in the URL below to correctly set up the SharePoint add-on:
Hope it helps. Thanks!
The instructions on the app page does not provide much help in troubleshooting this issue to be honest, my team and I have been tracking this questions for half a year now.
Did you manage to configure it to work properly on your end? It would be a great help if you could share your experience in this SharePoint App and Add-On!
Looking forward to hear back from you! 😄
Thanks for all the answers so far. I'm in the process of re-building my Sharepoint server, so once its rebuilt, I will try the (Splunk forwarder setup) process again. Once I do and if it's successful, I will post my results here.
The reason the SPWeb rebuilder stop there is because there's a mistake in the SPL.
If you have enough permission to access the configuration files, navigate to /$SPLUNKHOME/etc/apps/Splunkfor_Sharepoint/local to create or modify the savedsearches.conf. Look for the stanza [Lookup - SPWeb] and paste the following:
The error is due to an extra latest(Title) as Title in the stats command.
However, this does not solve the SP13inventory issue still unfortunately...