Hi,  I have installed new TA-MS-AD version (3.0.1) and I can see several errors : 01-27-2021 15:12:23.900 +0000 ERROR ExecProcessor - message from "/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/TA-MS-AAD/bin/azure_comp.py" ERROR'access_token' 01-27-2021 15:12:23.853 +0000 ERROR ExecProcessor - message from "/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/TA-MS-AAD/bin/azure_comp.py" KeyError: 'access_token' 01-27-2021 15:12:23.853 +0000 ERROR ExecProcessor - message from "/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/TA-MS-AAD/bin/azure_comp.py" return response['access_token'] 01-27-2021 15:12:23.853 +0000 ERROR ExecProcessor - message from "/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/TA-MS-AAD/bin/azure_comp.py" File "/opt/splunk/etc/apps/TA-MS-AAD/bin/ta_azure_utils/auth.py", line 59, in _get_access_token 01-27-2021 15:12:23.853 +0000 ERROR ExecProcessor - message from "/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/TA-MS-AAD/bin/azure_comp.py" raise e 01-27-2021 15:12:23.853 +0000 ERROR ExecProcessor - message from "/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/TA-MS-AAD/bin/azure_comp.py" File "/opt/splunk/etc/apps/TA-MS-AAD/bin/ta_azure_utils/auth.py", line 61, in _get_access_token 01-27-2021 15:12:23.853 +0000 ERROR ExecProcessor - message from "/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/TA-MS-AAD/bin/azure_comp.py" return _get_access_token(endpoint, helper, payload) 01-27-2021 15:12:23.853 +0000 ERROR ExecProcessor - message from "/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/TA-MS-AAD/bin/azure_comp.py" File "/opt/splunk/etc/apps/TA-MS-AAD/bin/ta_azure_utils/auth.py", line 51, in get_mgmt_access_token 01-27-2021 15:12:23.853 +0000 ERROR ExecProcessor - message from "/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/TA-MS-AAD/bin/azure_comp.py" raise e 01-27-2021 15:12:23.853 +0000 ERROR ExecProcessor - message from "/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/TA-MS-AAD/bin/azure_comp.py" File "/opt/splunk/etc/apps/TA-MS-AAD/bin/ta_azure_utils/auth.py", line 53, in get_mgmt_access_token 01-27-2021 15:12:23.853 +0000 ERROR ExecProcessor - message from "/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/TA-MS-AAD/bin/azure_comp.py" access_token = azauth.get_mgmt_access_token(client_id, client_secret, tenant_id, environment, helper) 01-27-2021 15:12:23.853 +0000 ERROR ExecProcessor - message from "/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/TA-MS-AAD/bin/azure_comp.py" File "/opt/splunk/etc/apps/TA-MS-AAD/bin/input_module_azure_comp.py", line 47, in collect_events 01-27-2021 15:12:23.853 +0000 ERROR ExecProcessor - message from "/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/TA-MS-AAD/bin/azure_comp.py" input_module.collect_events(self, ew) 01-27-2021 15:12:23.853 +0000 ERROR ExecProcessor - message from "/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/TA-MS-AAD/bin/azure_comp.py" File "/opt/splunk/etc/apps/TA-MS-AAD/bin/azure_comp.py", line 108, in collect_events 01-27-2021 15:12:23.853 +0000 ERROR ExecProcessor - message from "/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/TA-MS-AAD/bin/azure_comp.py" self.collect_events(ew) 01-27-2021 15:12:23.853 +0000 ERROR ExecProcessor - message from "/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/TA-MS-AAD/bin/azure_comp.py" File "/opt/splunk/etc/apps/TA-MS-AAD/bin/ta_ms_aad/aob_py3/modinput_wrapper/base_modinput.py", line 128, in stream_events 01-27-2021 15:12:23.853 +0000 ERROR ExecProcessor - message from "/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/TA-MS-AAD/bin/azure_comp.py" Traceback (most recent call last): 01-27-2021 15:09:30.187 +0000 ERROR ExecProcessor - message from "/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/TA-MS-AAD/bin/azure_comp.py" ERROR'access_token' 01-27-2021 15:09:30.126 +0000 ERROR ExecProcessor - message from "/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/TA-MS-AAD/bin/azure_comp.py" Key Error: 'access_token' 01-27-2021 15:09:30.126 +0000 ERROR ExecProcessor - message from "/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/TA-MS-AAD/bin/azure_comp.py" return response['access_token'] I checked the settings and all is right, BUT I does not indexing computing logs. Nothing goes back in splunk from compute input. The older version produce same error logs.  Can you help me ?   ... View more

Hi,  My issue is that I create 2 html inputs and I did not find a way to clear the value selected before.  <html> <div class="dateContainer"> <div class="dateInput"> <label>From :</label> <input id="start" type="datetime-local" searchWhenChanged="true"/> <label>To :</label> <input id="end" type="datetime-local" searchWhenChanged="true"/> </div> </div> </html> I tried this : <change> <condition match="isnotnull($value$) AND $value$!=&quot;&quot;"> </condition> </change> but it did not change anything. Can someone help please ? thanks.  ... View more

Hi, I create a dashboard which contains splunk 2 inputs and 2 html inputs :  1- the two html calendar inputs are not aligned to the splunk inputs : how can I do that ? 2- how to clean the two html calendar after selected values ?  Here is the code :      <fieldset submitButton="true" autoRun="false"> <input type="dropdown" token="application_tok" searchWhenChanged="true"> <label>Application</label> <fieldForLabel>app</fieldForLabel> <fieldForValue>app</fieldForValue> <search> <query>index=A sourcetype="B" | fields app | dedup app | sort app</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <change> <condition match="isnotnull($value$) AND $value$!=&quot;&quot;"> <set token="tokTextFilter">$value$</set> </condition> </change> </input> <input type="dropdown" token="environment_tok" searchWhenChanged="true"> <label>Environment</label> <fieldForLabel>env</fieldForLabel> <fieldForValue>env</fieldForValue> <search> <query>index=A sourcetype="B" | search app=$application_tok$ | fields env | dedup env | sort env</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <change> <condition match="isnotnull($value$) AND $value$!=&quot;&quot;"> <set token="tokTextFilter">$value$</set> </condition> </change> </input> <html> <div class="dateContainer"> <div class="dateInput"> <label>From :</label> <input id="start" type="datetime-local"/> <label>To :</label> <input id="end" type="datetime-local"/> </div> </div> </html> </fieldset>     here is my xml search code :      <row> <panel> <title>All token</title> <table> <search> <done> <unset token="form.start"></unset> <unset token="form.end"></unset> <unset token="form.application_tok"></unset> <unset token="form.environment_tok"></unset> </done> <query>| makeresults | eval Application="$application_tok$", Environment="$environment_tok$", Start="$start$", End="$end$" | fields - _time | table Application Environment Start End</query> <earliest>-10m</earliest> <latest></latest> <sampleRatio>1</sampleRatio> </search> <option name="count">100</option> <option name="dataOverlayMode">none</option> <option name="drilldown">none</option> <option name="percentagesRow">false</option> <option name="refresh.auto.interval">60</option> <option name="refresh.display">preview</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> </table> </panel> </row>       Thanks for your help ! ... View more

Hi, I have a weird reaction of my dropdown input :  It seems the input create a empty value in the dropdown choice whereas when I run the input request, the result is giving just ID list :  Here is my xml code :  <row> <panel> <title>ID list</title> <input type="dropdown" token="id_tok" searchWhenChanged="true"> <label>Select an ID to delete</label> <fieldForLabel>id</fieldForLabel> <fieldForValue>id</fieldForValue> <search> <query>| inputlookup id_list.csv | fields id | dedup id</query> <earliest>-1m@m</earliest> <latest>now</latest> </search> <prefix>"</prefix> <suffix>"</suffix> </input> <table> <search> <query>| makeresults | eval ID=$id_tok$ | fields - _time | dedup ID | outputlookup append=t id_delete.csv</query> <earliest>-1m</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> <refresh>1m</refresh> <refreshType>delay</refreshType> </search> <option name="count">20</option> <option name="dataOverlayMode">none</option> <option name="drilldown">none</option> <option name="percentagesRow">false</option> <option name="refresh.display">progressbar</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> </table> </panel> </row> Beside, my panel request does not seem to work : " Error in 'eval' command: Failed to parse the provided arguments. Usage: eval dest_key = expression."  The fact is that when I open the search, the token value is not set...  :      Can you help me ?  Thanks ! ... View more

Hi,  I have a script which output a csv file :  id,name,env,start,end 1234,test,[env]:dev,2020-12-31 18:07,2020-12-31 19:07 The first line is the header and ALL lines in file must be reindexed each time there is a modification (adding or a suppression).  I have an inputs.conf like this :  [monitor:///opt/splunk/etc/apps/my_app/bin/my_csv.csv] index = test sourcetype = st disabled = 0 initCrcLength = 3000 I have a props.conf like :  [st] DATETIME_CONFIG = INDEXED_EXTRACTIONS = csv KV_MODE = none NO_BINARY_CHECK = true SHOULD_LINEMERGE = false category = Structured description = Comma-separated value format. Set header and other settings in "Delimited Settings" disabled = false pulldown_type = true The indexation is really weird : it actually index only the header : Can you help me please ? Thank a lot.   ... View more

Hi, I have a script on heavy forwarder which output a csv file in /bin  I have an inputs.conf set like this :  [script://./bin/my_script.py] interval = * * * * * index = test sourcetype = test:st disabled = 0 [monitor:///opt/splunk/etc/apps/my_app/bin/csv_file.csv] index = test sourcetype = test:st disabled = 0 crcSalt = <SOURCE> My props.conf : SHOULD_LINEMERGE = false FIELD_DELIMITER=, HEADER_FIELD_LINE_NUMBER = 1 HEADER_FIELD_DELIMITER=, INDEXED_EXTRACTIONS=csv My issue is that my csv is not indexed on splunk. In index=_internal I have this INFO message :  12/30/20 3:35:14.261 PM  INFO TailingProcessor - Adding watch on path: /opt/splunk/etc/apps/my_app/bin/csv_file.csv. host = heavy-forwarder index = _internal log_level = INFO source = /opt/splunk/var/log/splunk/splunkd.log sourcetype = splunkd 12/30/20 3:35:14.261 PM 12-30-2020 14:35:14.261 +0000 INFO TailingProcessor - Parsing configuration stanza: monitor:///opt/splunk/etc/apps/my_app/bin/csv_file.csv. INFO ExecProcessor - setting reschedule_ms=59661, for command=python /opt/splunk/etc/apps/my_app/bin/my_script.py No ERROR message at script level also... What I did wrong ? ... View more

Hi,  I want to use condition to set a "show" OR a "hide" panel (if no result) :  <row depends="$panel_hide$"> <panel id="no_result"> <title>List</title> <html> <style> #clear .dashboard-panel {background: white;} </style> <center> <h2>No result<i class="icon-check icon-no-underline" style="font-size:100%;color:#65a637;"/> </h2> </center> </html> </panel> </row> <row depends="$panel_show$"> <panel> <title>List</title> <table> <search> <query>index=A sourcetype="B" id=* | table id name start end | sort - start</query> <earliest>-10m</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> <finalized> <condition match="$job.resultCount$&gt;0"> <set token="panel_show">true</set> </condition> <condition> <set token="panel_hide"></set> <unset token="panel_show"></unset> </condition> </finalized> </search> <option name="count">20</option> <option name="dataOverlayMode">none</option> <option name="drilldown">none</option> <option name="percentagesRow">false</option> <option name="refresh.display">progressbar</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> </table> </panel> </row> This code not working... It gives me both panel :    What it is wrong with my code ? Thanks for help. ... View more