All Apps and Add-ons

sourcetypes not working in Okta app

boxjgerace
New Member

I just installed the new Splunk app for Okta. Everything seems to be working fine, except that I cannot query anything based on sourcetype alone. For example: a query for "sourcetype=okta:sso" does not return any results, but a query for "index=okta sourcetype=okta:sso" does work. This is a problem because the included eventtypes and the dashboards do not search with index=okta in the query, thus all the dashboards are empty.

Any ideas?

0 Karma

pstout
Splunk Employee
Splunk Employee

Hello,

We released a new version of the Okta app yesterday that addressed this issue (among others) -- hopefully this helps!

0 Karma

bwindham
Path Finder

I ran into the same thing. I probably should not have but I added "index=okta" to the searches to correct it for my instance. Probably a permission issue but I wanted to get the app up and running quickly. I'd like to hear how others may have corrected this appropriately rather than the bandaid approach that I did. Another issue I ran into, intermittently, is in regards to the maps. I get "Error in 'script': Getinfo probe failed for external search command 'geoip'"...it eventually works on second or third refresh.

0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...