Thx for the reply and info, but I actually opened a case with Microsoft about this and they said the issue was on their side and that they just fixed it.  I had all permissions and configs set correctly, but once they fixed their issue, sign in events/logs started to flow in.   Thx ... View more

@robayers  I've been messing around with this app for a few days and just got it working after seeing the same errors as you. You'll want to make sure your API permissions are set correctly and admin consent is granted in Azure then double check your configuration and input settings in the app. When adding the account under configuration in the app make sure you're using the Application (Client) ID found in the Overview section in Azure rather than the Client Secrets ID, this ended up being my issue. Also check that your traffic isn't getting blocked somewhere in your network. I found another thread where someone mentioned that was their issue. I can't find it again but they said something about their firewall not liking the endpoint input option set to worldwide and they were able to get it to work by setting that to USGovGCCHigh so that may be worth trying. ... View more

I wanted to provide an answer more specific to the "Microsoft Graph Security API Add-On for Splunk." I just installed this app (Version 1.2.1) and immediately hit this issue in my distributed environment (SHC, IDXC, HFs). It seems the problem is that the app includes: INDEXED_EXTRACTIONS = json KV_MODE = json Since it is recommended to be installed on both the search head and the heavy forwarder, this means the fields are indexed on the heavy forwarder, then again extracted on the SH which results in two values.  I guess you have to options, turn off KVmode on your search head or turn off Index-time extractions. Personally I did the latter by adding this to my heavy forwarder: TA-microsoft-graph-security-add-on-for-splunk/local/props.conf [GraphSecurityAlert] INDEXED_EXTRACTIONS =   ... View more

Do you have the same matrix for authentication extensions where Azure SSO is the IdP and SAML is the used? ... View more

Is the sourcetype [mscs:azure:security:recommendation] still part of Splunk Add-on for Microsoft Cloud Services? I have enabled all the inputs, but this sourcetype does not show up.  The dashboard, Security Center Recommendations, in Splunk App Template for Microsoft Azure is blank.  ... View more

Hi @woodcock    I'm triying this solutions without good results. I'm receiving message info after config the props.conf. In deploy server, into the app, in local/props.conf I configure the parameters. Do i Need anymore things?   Thanks! ... View more

Thx Rich - I'll create a new file under the /local directory ... View more

Rich, Thx for the reply. The input I had to use was the custom data type that does not have a corresponding stanza in props.conf. I was seeing events as follows with timestamps a few hours ahead: Oct 22 22:10:01 ip-X-X-X-X systemd: Stopping User Slice of root.    I created a props.conf file in the local dir of the add-on on my HF and added the following stanza: [aws:s3:hostOS] TZ = GMT and now when I run a search the timestamps are as follows: Oct 22 22:13:06 ip-x-x-x-x dhclient[3010]: XMT: Solicit on eth0, interval 127130ms.   I believe this fixed the issue Thx ... View more

Figured out the issue after banging away for a little - I had to drop the quotes from the nodenames   | tstats summariesonly=true allow_old_summaries=true count from datamodel="Network_Traffic" WHERE nodename=All_Traffic.Traffic_By_Action.Blocked_Traffic BY _time span=1h   ... View more

This was my solution to an hourly count issue. I've sanitized it. But I created this for a dashboard which watches inbound firewall traffic by country ($token_value$) per hour. Both Allowed and Dropped traffic. index=firewall sourcetype=traffic action=* location=$token_value$ earliest=-1d@d latest=@d | eval date_hour=strftime(_time, "%H") | stats count as "Hourly Count" by action, location, date_hour | sort date_hour by ascending     ... View more

Big help in posting this - TYVM! ... View more

@jwalzerpitt  Thank you for mentioning correct answer ... View more

Finally figured this out. Used the following which worked: EXTRACT-foo_user = ,foo(?:\\\\|\\)(?<user>[^,]+), ... View more

Awesome - thx so much! ... View more

Yes, JSON is not valid. Put keys and string values in double quotes like below, change Timestamp format to %Y-%m-%d %H:%M:%S and add new setting (under Advanced dropdown) TIMESTAMP_FIELDS = received. {"received": "2020-02-27 10:49:07", "operator_id": "None", "sender": "A"} ... View more

If this suggestion resolved your issue, please consider accepting the answer, as it benefits others. ... View more

| tstats count where index=foo prestats=t by _time span=1d | timechart count | eventstats avg(count) as daily_avg Visualization with overlay daily_avg How about this? ... View more

Sample query: | makeresults count=1000 | eval src="A.A.A.A#B.B.B.B#C.C.C.C#D.D.D.D" | eval action="pass#fail" | eval src=mvindex(split(src,"#"),random() % 3) | eval action=mvindex(split(action,"#"),random() % 2) | chart limit=0 count by src action | eval failPerc=round(fail / ( fail + pass ) * 100,2) recommend: index=foo action=fail OR action=pass | chart limit=0 useother=f usenull=f count by src action | eval failPerc=round(fail / ( fail + pass ) * 100,2) ... View more

index=_internal source="*license_usage.log" type="RolloverSummary" earliest=-30d@d | bin _time span=1d | eventstats sum(stacksz) as a by _time | eventstats avg(a) as stack_avg | stats latest(b) AS b values(a) as stack_size values(stack_avg) as stack_avg by slave, pool, _time | timechart span=1d sum(b) AS "volume" values(stack_size) as "stack size" values(stack_avg) as "stack avg" fixedrange=false | foreach "*" [ eval <<FIELD>>=round('<<FIELD>>'/1024/1024/1024, 3)] Hi, @jwalzerpitt | eval _time=_time - 43200 what 's this? ... View more

Probably the string failed is in your logs and it is a simple field extraction. If that's the case, then you need to create a calculated field that does: eval action=if(action=="failed", "failure", action) ... View more

Pipe the results of your query to "fieldsummary", which by default provides both "count" and "distinct_count". I think this will get you the data you're after, based on your question. See this documentation for more detailed explanation: https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Fieldsummary ... View more

TYVM - worked perfectly ... View more