What event will tell me a new index was created in Splunk Cloud? ... View more

1.Change the permissions for the original Dashboard to Global. 2.Open your new app, go to Dashboards, look for the Dashboard and Clone it (Edit->Clone), it will clone into the new App. 3.If you don't want the original dashboard to be on the original App you can delete it after being cloned. 4.Profit!! ... View more

To access sys.fn_get_audit_file you need, at least, CONTROL SERVER role ... View more

The problem was that TCP ports 5671 and 5672 were blocked from the Internal firewall out to the Internet. “... data inputs use AMQP to connect to event hub over TLS using ports 5671 / 5672 as described in the AMQP 1.0 Service Bus and Event Hubs protocol guide. So, if you are having connection/authentication issues, check that these ports are open on your Splunk instance.” The network administrator just allowed connections to these ports and the data started coming in!! ... View more

I just noticed this Add-on is for Ubuntu or Darwin systems, what would I need for CentOS? Any particular Python libs? ... View more

That doesn't seem to be the problem 😞 Here are more errors from running index=_internal sourcetype="ta:ms:aad:log" source=*hub* 2019-10-30 15:54:47,997 INFO pid=44249 tid=MainThread file=mgmt_operation.py:__init__:65 | 'Failed opening message receiver' ('/data/src/vendor/azure-uamqp-c/src/amqp_management.c':'amqp_management_open_async':981) 2019-10-30 15:54:47,997 INFO pid=44249 tid=MainThread file=mgmt_operation.py:__init__:65 | 'Link attach failed' ('/data/src/vendor/azure-uamqp-c/src/message_receiver.c':'messagereceiver_open':362) 2019-10-30 15:54:47,997 INFO pid=44249 tid=MainThread file=mgmt_operation.py:__init__:65 | 'Begin session failed' ('/data/src/vendor/azure-uamqp-c/src/link.c':'link_attach':1154) 2019-10-30 15:54:47,996 INFO pid=44249 tid=MainThread file=connection.py:_state_changed:181 | Connection with ID '8a0fbd26-fffa-4ace-993b-455aef8737bd' unexpectedly in an error state. Closing: False, Error: None 2019-10-30 15:54:47,996 INFO pid=44249 tid=MainThread file=connection.py:_state_changed:177 | Connection '8a0fbd26-fffa-4ace-993b-455aef8737bd' state changed from <ConnectionState.START: 0> to <ConnectionState.END: 13> 2019-10-30 15:54:47,996 INFO pid=44249 tid=MainThread file=mgmt_operation.py:__init__:65 | 'Opening the underlying IO failed' ('/data/src/vendor/azure-uamqp-c/src/connection.c':'connection_open':1344) 2019-10-30 15:54:47,996 INFO pid=44249 tid=MainThread file=mgmt_operation.py:__init__:65 | 'xio_open failed' ('/data/src/vendor/azure-uamqp-c/src/saslclientio.c':'saslclientio_open_async':1097) 2019-10-30 15:54:47,996 INFO pid=44249 tid=MainThread file=mgmt_operation.py:__init__:65 | 'Failed opening the underlying I/O.' ('/data/src/vendor/azure-uamqp-c/deps/azure-c-shared-utility/adapters/tlsio_openssl.c':'tlsio_openssl_open':1258) 2019-10-30 15:54:47,996 INFO pid=44249 tid=MainThread file=mgmt_operation.py:__init__:65 | 'Invalid tlsio_state. Expected state is TLSIO_STATE_OPENING_UNDERLYING_IO.' ('/data/src/vendor/azure-uamqp-c/deps/azure-c-shared-utility/adapters/tlsio_openssl.c':'on_underlying_io_open_complete':760) 2019-10-30 15:54:47,996 INFO pid=44249 tid=MainThread file=mgmt_operation.py:__init__:65 | 'Closing tlsio from a state other than TLSIO_STATE_EXT_OPEN or TLSIO_STATE_EXT_ERROR' 2019-10-30 15:54:47,995 INFO pid=44249 tid=MainThread file=mgmt_operation.py:__init__:65 | 'wait_for_connection failed' ('/data/src/vendor/azure-uamqp-c/deps/azure-c-shared-utility/adapters/socketio_berkeley.c':'socketio_open':770) 2019-10-30 15:54:47,989 INFO pid=44249 tid=MainThread file=connection.py:_state_changed:177 | Connection '8a0fbd26-fffa-4ace-993b-455aef8737bd' state changed from <ConnectionState.START: 0> to <ConnectionState.START: 0> 2019-10-30 15:54:47,988 INFO pid=44249 tid=MainThread file=connection.py:_close:136 | Connection shutdown complete 'fda99a3d-6f6a-44d1-8921-8bf1d235fb95'. 2019-10-30 15:54:47,988 INFO pid=44249 tid=MainThread file=connection.py:_close:129 | Shutting down connection 'fda99a3d-6f6a-44d1-8921-8bf1d235fb95'. 2019-10-30 15:54:47,988 INFO pid=44249 tid=MainThread file=error.py:_handle_exception:233 | u'eventhub.pysdk-5ec316b9' has an exception (AMQPConnectionError('Unable to open management session. Please confirm URI namespace exists.',)). Retrying... 2019-10-30 15:54:47,187 INFO pid=44249 tid=MainThread file=mgmt_operation.py:__init__:65 | 'Failed opening message receiver' ('/data/src/vendor/azure-uamqp-c/src/amqp_management.c':'amqp_management_open_async':981) 2019-10-30 15:54:47,187 INFO pid=44249 tid=MainThread file=mgmt_operation.py:__init__:65 | 'Link attach failed' ('/data/src/vendor/azure-uamqp-c/src/message_receiver.c':'messagereceiver_open':362) 2019-10-30 15:54:47,186 INFO pid=44249 tid=MainThread file=mgmt_operation.py:__init__:65 | 'Begin session failed' ('/data/src/vendor/azure-uamqp-c/src/link.c':'link_attach':1154) 2019-10-30 15:54:47,186 INFO pid=44249 tid=MainThread file=connection.py:_state_changed:181 | Connection with ID 'fda99a3d-6f6a-44d1-8921-8bf1d235fb95' unexpectedly in an error state. Closing: False, Error: None 2019-10-30 15:54:47,186 INFO pid=44249 tid=MainThread file=connection.py:_state_changed:177 | Connection 'fda99a3d-6f6a-44d1-8921-8bf1d235fb95' state changed from <ConnectionState.START: 0> to <ConnectionState.END: 13> 2019-10-30 15:54:47,186 INFO pid=44249 tid=MainThread file=mgmt_operation.py:__init__:65 | 'Opening the underlying IO failed' ('/data/src/vendor/azure-uamqp-c/src/connection.c':'connection_open':1344) 2019-10-30 15:54:47,186 INFO pid=44249 tid=MainThread file=mgmt_operation.py:__init__:65 | 'xio_open failed' ('/data/src/vendor/azure-uamqp-c/src/saslclientio.c':'saslclientio_open_async':1097) 2019-10-30 15:54:47,186 INFO pid=44249 tid=MainThread file=mgmt_operation.py:__init__:65 | 'Failed opening the underlying I/O.' ('/data/src/vendor/azure-uamqp-c/deps/azure-c-shared-utility/adapters/tlsio_openssl.c':'tlsio_openssl_open':1258) 2019-10-30 15:54:47,186 INFO pid=44249 tid=MainThread file=mgmt_operation.py:__init__:65 | 'Invalid tlsio_state. Expected state is TLSIO_STATE_OPENING_UNDERLYING_IO.' ('/data/src/vendor/azure-uamqp-c/deps/azure-c-shared-utility/adapters/tlsio_openssl.c':'on_underlying_io_open_complete':760) 2019-10-30 15:54:47,185 INFO pid=44249 tid=MainThread file=mgmt_operation.py:__init__:65 | 'Closing tlsio from a state other than TLSIO_STATE_EXT_OPEN or TLSIO_STATE_EXT_ERROR' 2019-10-30 15:54:47,185 INFO pid=44249 tid=MainThread file=mgmt_operation.py:__init__:65 | 'wait_for_connection failed' ('/data/src/vendor/azure-uamqp-c/deps/azure-c-shared-utility/adapters/socketio_berkeley.c':'socketio_open':770) 2019-10-30 15:54:47,178 INFO pid=44249 tid=MainThread file=connection.py:_state_changed:177 | Connection 'fda99a3d-6f6a-44d1-8921-8bf1d235fb95' state changed from <ConnectionState.START: 0> to <ConnectionState.START: 0> 2019-10-30 15:54:47,176 INFO pid=44249 tid=MainThread file=client_abstract.py:__init__:161 | u'eventhub.pysdk-5ec316b9': Created the Event Hub client 2019-10-30 15:54:47,175 INFO pid=44249 tid=MainThread file=setup_util.py:log_info:114 | Proxy is not enabled! 2019-10-30 15:54:46,241 INFO pid=44249 tid=MainThread file=connectionpool.py:_new_conn:758 | Starting new HTTPS connection (1): 127.0.0.1 2019-10-30 15:54:45,295 INFO pid=44249 tid=MainThread file=connectionpool.py:_new_conn:758 | Starting new HTTPS connection (1): 127.0.0.1 2019-10-30 15:54:44,749 INFO pid=44249 tid=MainThread file=connectionpool.py:_new_conn:758 | Starting new HTTPS connection (1): 127.0.0.1 2019-10-30 15:54:44,068 INFO pid=44249 tid=MainThread file=connectionpool.py:_new_conn:758 | Starting new HTTPS connection (1): 127.0.0.1 2019-10-30 15:54:42,763 ERROR pid=44198 tid=MainThread file=base_modinput.py:log_error:307 | Get error when collecting events. Traceback (most recent call last): File "/opt/splunk/etc/apps/TA-MS-AAD/bin/ta_ms_aad/modinput_wrapper/base_modinput.py", line 127, in stream_events self.collect_events(ew) File "/opt/splunk/etc/apps/TA-MS-AAD/bin/azure_event_hub.py", line 92, in collect_events input_module.collect_events(self, ew) File "/opt/splunk/etc/apps/TA-MS-AAD/bin/input_module_azure_event_hub.py", line 112, in collect_events partition_ids = client.get_partition_ids() File "/opt/splunk/etc/apps/TA-MS-AAD/bin/azure/eventhub/client.py", line 163, in get_partition_ids return self.get_properties()['partition_ids'] File "/opt/splunk/etc/apps/TA-MS-AAD/bin/azure/eventhub/client.py", line 146, in get_properties response = self._management_request(mgmt_msg, op_type=b'com.microsoft:eventhub') File "/opt/splunk/etc/apps/TA-MS-AAD/bin/azure/eventhub/client.py", line 127, in _management_request self._handle_exception(exception, retry_count, max_retries) File "/opt/splunk/etc/apps/TA-MS-AAD/bin/azure/eventhub/client.py", line 105, in _handle_exception _handle_exception(exception, retry_count, max_retries, self) File "/opt/splunk/etc/apps/TA-MS-AAD/bin/azure/eventhub/error.py", line 196, in _handle_exception raise error ConnectError: Unable to open management session. Please confirm URI namespace exists. Unable to open management session. Please confirm URI namespace exists. 2019-10-30 15:54:42,762 INFO pid=44198 tid=MainThread file=connection.py:_close:136 | Connection shutdown complete 'c0b76f33-cac3-44bc-b6b2-a7798c8d363f'. 2019-10-30 15:54:42,762 INFO pid=44198 tid=MainThread file=connection.py:_close:129 | Shutting down connection 'c0b76f33-cac3-44bc-b6b2-a7798c8d363f'. ... View more

I changed the line FIELDALIAS-s_computername = s_computername as host to FIELDALIAS-s_computername = s_computername ASNEW host so it won't overwrite the value with null() since my IIS logs don't have s_computername field ... View more

You need to install the Xen App SDK 6.5 on your Windows Server. ... View more

Only the [udp://<remote server>:<port>] stanza has the no_appending_timestamp You can read about it here ... View more

OK, so if you are looking for only the latest events then you just might need to use a time function like latest() to filter out the old events you don't want for the report https://docs.splunk.com/Documentation/Splunk/7.3.1/SearchReference/Timefunctions <your search here> | stats latest(User) AS User by Action ... View more

Events can certainly be deleted using |delete command after a search, but the user needs delete permissions which is not given by default to any account, no even admin. This doesn't remove the event from the bucket though, just marks it as unsearchable. ... View more

Hello, Sorry, I would like to know why you want to do this? What's the final goal? Usually companies what to keep a historical record of transactions like the one you described. Are you trying to make a report and you only want the latest data? ... View more

Are all these extractions for \sPFE_FW_SYSLOG_ETH_IP:\sFW: for one event? I mean, are you expecting that any event that matches the \sPFE_FW_SYSLOG_ETH_IP:\sFW: would do the last 4 extractions? If yes, I would just do one big regex with all the extractions. Also, make sure you don't have another knowledge object rewriting the src field, like a lookup table ... View more

This depends if you have the Splunk Add-on for Windows installed for extractions and calculations of the fields or not. If yes, IpAddress should match calculated field src_ip, EventID would be EventCode, TargettUserName should be user So you'll have a search like: index=<index_with_windows_events> EventCode=4624 (src_ip=10.228.36.66 OR user=ztm31029) If not, we would need to see how the RAW data looks in Splunk to do the proper extractions and calculations, or just match to a regular expression. ... View more

Can you post a sample of the event and what is currently being extracted? it's hard to understand what you are trying to do. So a Field called token is extracted and it's value could be a String like "121 or 265"? You could do an extraction on the token field: ... | rex field=token "(?<token1>\d{3})\sor\s(?<token2>\d{3})" This will create 2 new fields, token1 and token2 ... View more

This is a serious bug, customers are not capturing all events in Splunk. We need a new version of this Add-on. ... View more

Found a workaround https://answers.splunk.com/answers/715709/salesforce-add-on-v20-misses-indexing-events-from.html ... View more

This actually pulled the first 90 days of events as expected by default but after that it stopped pulling data The logs in _internal are not showing any errors, but the API call seems to have gotten stuck in the last checkpoint forever. ... View more

I have the same issue, just asked our account manager to change the permissions. Thanks ... View more

I've answer my own question but I'm having another issue Object Fields should be = Id,Action,Section,CreatedDate,CreatedById,Display,DelegateUser,ResponsibleNamespacePrefix Orther By field should be = CreatedDate But it pulls the initial 90 days of logs and then it never pulls again. ... View more