Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About kmanson
kmanson
Path Finder
Member since:
10-07-2011
06-05-2020
Community Statistics
| Posts | 42 |
| Solutions | 5 |
| Karma Given | 12 |
| Karma Received | 38 |
| Member Since | 10-07-2011 |
Activity Feed
- Karma Splunk Add-on for Nessus Tenable API: Getting error "Fail to decrypt the encrypted credential information - not well-formed (invalid token)"? for jonathan_cooper. 06-05-2020 12:48 AM
- Karma Re: Search formatting in Splunk 6.5.0 for easier readability for lquinn. 06-05-2020 12:48 AM
- Karma Re: Error after Enterprise Security Upgrade to 4.1.2 for jwelch_splunk. 06-05-2020 12:48 AM
- Karma Re: Splunk Add-on for Tenable: Why is the add-on not able to communicate with the Tenable Security Center? for tkreiner. 06-05-2020 12:48 AM
- Karma Re: Splunk add on for Cisco IPS 2.1.5 has error conneting to sensor for klaxdal. 06-05-2020 12:48 AM
- Karma Re: Support for the 'Authentication' and 'Network Session' data models on the Splunk_TA_paloalto for btorresgil. 06-05-2020 12:48 AM
- Karma Re: Checkpoint Add-on for Check Point OPSEC LEA: Why is the "Manage Connections" page loading forever? for sha1020. 06-05-2020 12:48 AM
- Karma Windows Server 2016 compatibility for nicocin. 06-05-2020 12:48 AM
- Got Karma for Re: Splunk Add-on for Microsoft SQL Server: The lookup table 'sqlserver_host_dbserver_lookup' does not exist.. 06-05-2020 12:48 AM
- Got Karma for Re: Splunk Add-on for Microsoft SQL Server: The lookup table 'sqlserver_host_dbserver_lookup' does not exist.. 06-05-2020 12:48 AM
- Got Karma for Re: Splunk Add-on for Microsoft SQL Server: The lookup table 'sqlserver_host_dbserver_lookup' does not exist.. 06-05-2020 12:48 AM
- Got Karma for Re: Splunk Add-on for Microsoft SQL Server: The lookup table 'sqlserver_host_dbserver_lookup' does not exist.. 06-05-2020 12:48 AM
- Got Karma for Re: Splunk Add-on for Microsoft SQL Server: The lookup table 'sqlserver_host_dbserver_lookup' does not exist.. 06-05-2020 12:48 AM
- Got Karma for Re: Splunk Add-on for Microsoft SQL Server: The lookup table 'sqlserver_host_dbserver_lookup' does not exist.. 06-05-2020 12:48 AM
- Got Karma for Re: Splunk Add-on for Microsoft SQL Server: The lookup table 'sqlserver_host_dbserver_lookup' does not exist.. 06-05-2020 12:48 AM
- Got Karma for Re: Splunk Add-on for Microsoft SQL Server: The lookup table 'sqlserver_host_dbserver_lookup' does not exist.. 06-05-2020 12:48 AM
- Got Karma for Re: Splunk Add-on for Microsoft SQL Server: The lookup table 'sqlserver_host_dbserver_lookup' does not exist.. 06-05-2020 12:48 AM
- Got Karma for Re: Splunk Add-on for Microsoft SQL Server: The lookup table 'sqlserver_host_dbserver_lookup' does not exist.. 06-05-2020 12:48 AM
- Got Karma for Re: Splunk Add-on for Microsoft SQL Server: The lookup table 'sqlserver_host_dbserver_lookup' does not exist.. 06-05-2020 12:48 AM
- Got Karma for Splunk Add-on for Microsoft Cloud Services: No permission to fetch Azure AD Audit data.. 06-05-2020 12:48 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 8 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 |
06-21-2017
03:09 AM
Changing the Dimension Names got it working, but still not exactly sure why the first list doesn't work
from this
[{"InstanceId": ".*", "AutoScalingGroupName": ".*", "InstanceType": ".*", "ImageId": ".*"}]
to this
[{"InstanceId": ".*"}]
... View more
06-21-2017
03:01 AM
Any luck on a solution yet?
... View more
06-13-2017
04:28 AM
First time setting up the Splunk version of this app, normally just use the crowdstrike version that downloads the logs and just create inputs to monitor.
2017-06-13 11:21:17,081 +0000 log_level=ERROR, pid=31446, tid=Thread-4, file=ta_data_collector.py, func_name=_do_safe_index, code_line_no=170 | [stanza_name="company_cs"] Failed to get msg
Traceback (most recent call last):
File "/opt/app/splunk/etc/apps/Splunk_TA_crowdstrike/bin/splunk_ta_crowdstrike/splunktaucclib/data_collection/ta_data_collector.py", line 160, in _do_safe_index
events, ckpt = self._client.get()
File "/opt/app/splunk/etc/apps/Splunk_TA_crowdstrike/bin/splunk_ta_crowdstrike/falcon_host_data_client.py", line 60, in get
self._initialize()
File "/opt/app/splunk/etc/apps/Splunk_TA_crowdstrike/bin/splunk_ta_crowdstrike/falcon_host_data_client.py", line 104, in _initialize
app_id=app_id, proxies=proxies, name=self._stanza)
File "/opt/app/splunk/etc/apps/Splunk_TA_crowdstrike/bin/splunk_ta_crowdstrike/falcon_host_stream_api.py", line 31, in consume
stream = _discover_streams(name, fire_host, api_uuid, api_key, app_id, proxies)
File "/opt/app/splunk/etc/apps/Splunk_TA_crowdstrike/bin/splunk_ta_crowdstrike/falcon_host_stream_api.py", line 42, in _discover_streams
proxies=proxies))
File "/opt/app/splunk/etc/apps/Splunk_TA_crowdstrike/bin/splunk_ta_crowdstrike/falcon_host_stream_api.py", line 151, in _ensure_response
response.raise_for_status()
File "/opt/app/splunk/etc/apps/Splunk_TA_crowdstrike/bin/splunk_ta_crowdstrike/requests/models.py", line 862, in raise_for_status
raise HTTPError(http_error_msg, response=self)
HTTPError: 500 Server Error: Internal Server Error for url: https://firehose.crowdstrike.com/sensors/entities/datafeed/v1?appId=splunk-ta-sh1.company.domainj2
... View more
05-17-2017
09:27 AM
1 Karma
We gave up on using this app to pull Windows logs from storage tables for the exact same reason, delays in indexing. We opened a Support case on 10/27/16 and on 1/4/17 the final answer was it was working as intended. We ending up using the Microsoft SIEM connector. It works great to pull many Azure log sources.
https://docs.microsoft.com/en-us/azure/security/security-azure-log-integration-overview
... View more
03-08-2017
05:43 AM
Updated docs URL, http://docs.splunk.com/Documentation/Splunk/latest/Data/Configuretimestamprecognition
... View more
02-10-2017
12:55 PM
Say What? The app page says it supports Splunk 6.5 is that not true?
https://splunkbase.splunk.com/app/3457/
... View more
01-05-2017
04:05 AM
Apparently this is by design, way to go Splunk!
The updated information for this issue is that the Add-On is currently working as intended. There has been an Enhancement request entered to have this addressed in a future development timeline.
... View more
Ok just figured out the answer, but please update the docs. It's correct in http://docs.splunk.com/Documentation/Splunk/6.5.1/Admin/Inputsconf#http:_.28HTTP_Event_Collector.29 but not in dev.splunk.com
The default is apparently in %SPLUNK_HOME%/etc/apps/splunk_httpinput/default/inputs.conf as
[http]
# ssl settings are similar to mgmt server
sslVersions=*,-ssl2
allowSslCompression=true
allowSslRenegotiation=true
Added the stanza below to %SPLUNK_HOME%/etc/apps/splunk_httpinput/local/inputs.conf
[http]
sslVersions=tls1.1, tls1.2
... View more
I am trying to disable SSLv3 and TLS1.0 on HTTP Event Collector, for the life of me I can't figure out where to set the allowed sslVersions. It's already set in %SPLUNK_HOME%/etc/system/local/server.conf
[sslConfig]
sslVersions = tls1.1, tls1.2
Whether the HTTP Event Collector server protocol is HTTP or HTTPS. 1 indicates HTTPS; 0 indicates HTTP. The default value is 1. If you set enableSSL to 1, HTTP Event Collector uses the SSL settings specified in the [general] stanza of the server.conf file.
source: http://dev.splunk.com/view/event-collector/SP-CAAAE6Q
The [general] stanza doesn’t have SSL settings, that's in [sslConfig]
... View more
11-02-2016
08:03 AM
Very helpful information, we are just waiting on 6.5.1 before upgrading. Let us test in a dev environment and I will accept this as the answer.
... View more
11-01-2016
04:24 AM
I actually used "IIS" sourcetype, "ms:iis:auto" appears to be the same with the additional alias and evals. "ms:iis:default" will not work since it's not default fields.
Software: Microsoft Internet Information Services 8.0
Fields: date time s-sitename cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) cs(Cookie) cs(Referer) cs-host sc-status sc-substatus sc-win32-status sc-bytes cs-bytes time-taken
[iis]
pulldown_type = true
MAX_TIMESTAMP_LOOKAHEAD = 32
SHOULD_LINEMERGE = False
INDEXED_EXTRACTIONS = w3c
detect_trailing_nulls = auto
category = Web
description = W3C Extended log format produced by the Microsoft Internet Information Services (IIS) web server
... View more
11-01-2016
03:59 AM
It might not be the same issue, but I will keep everyone updated. I also have support case opened for my issue as well.
... View more
10-31-2016
06:50 AM
Is there anyway to get the Splunk native IIS extractions to work with the Splunk Add-on for Microsoft Cloud Services? Setting the sourcetype to IIS doesn't extract the fields. If I download the actual log file from the Azure storage blob using Storage Explorer and one shot the file it works great, not so much when pulling the logs with this app.
Splunk 6.4
Splunk Add-on for Microsoft Cloud Services 2.0.1
... View more
10-25-2016
04:40 AM
Trying to figure out the delay in reading from an Azure Storage table. According to the logs, the event happened at 14:24, 5mins later it wrote to storage table, 75mins later Splunk indexed the event.
Example Event
_time: 2016-10-24 14:24:58.395 (_time taken from EventTime)
_indextime: 2016-10-24 15:44:34 (Indexed Time)
Timestamp: 2016-10-24T14:29:35.0328389Z (Time event wrote to storage table)
EventTime: 2016-10-24T14:24:58.395405Z (Time event occured)
inputs.conf
[mscs_storage_table://LinuxsyslogVer2v0]
account = REDACTED
collection_interval = 120
index = os
sourcetype = mscs:storage:linux
start_time = 2016-10-13T00:00:00+00:00
table_list = LinuxsyslogVer2v0
These scheduler.py happen every 120 seconds, until 16:18:44 when the file=mscs_storage_table_data_collector.py runs again.
2016-10-24 16:18:44,214 +0000 log_level=INFO, pid=60713, tid=Thread-126, file=mscs_storage_table_data_collector.py, func_name=do_collect_data, code_line_no=79 | [stanza_name="LinuxsyslogVer2v0" account_name="jetprdeast2audit" table_name="LinuxsyslogVer2v0"] The filter is "(Timestamp ge datetime'2016-10-24T14:29:44Z') and (Timestamp lt datetime'2016-10-24T16:17:44Z')".
2016-10-24 14:40:44,179 +0000 log_level=INFO, pid=60713, tid=Thread-7, file=thread_pool.py, func_name=_run, code_line_no=261 | Thread work_queue_size=0
2016-10-24 14:40:44,178 +0000 log_level=INFO, pid=60713, tid=Thread-2, file=scheduler.py, func_name=get_ready_jobs, code_line_no=100 | Get 1 ready jobs, next duration is 119.999464, and there are 1 jobs scheduling
2016-10-24 14:38:44,179 +0000 log_level=INFO, pid=60713, tid=Thread-6, file=thread_pool.py, func_name=_run, code_line_no=261 | Thread work_queue_size=0
2016-10-24 14:38:44,179 +0000 log_level=INFO, pid=60713, tid=Thread-2, file=scheduler.py, func_name=get_ready_jobs, code_line_no=100 | Get 1 ready jobs, next duration is 119.999281, and there are 1 jobs scheduling
2016-10-24 14:36:44,179 +0000 log_level=INFO, pid=60713, tid=Thread-4, file=thread_pool.py, func_name=_run, code_line_no=261 | Thread work_queue_size=0
2016-10-24 14:36:44,178 +0000 log_level=INFO, pid=60713, tid=Thread-2, file=scheduler.py, func_name=get_ready_jobs, code_line_no=100 | Get 1 ready jobs, next duration is 119.999461, and there are 1 jobs scheduling
2016-10-24 14:34:44,179 +0000 log_level=INFO, pid=60713, tid=Thread-7, file=thread_pool.py, func_name=_run, code_line_no=261 | Thread work_queue_size=0
2016-10-24 14:34:44,178 +0000 log_level=INFO, pid=60713, tid=Thread-2, file=scheduler.py, func_name=get_ready_jobs, code_line_no=100 | Get 1 ready jobs, next duration is 119.999312, and there are 1 jobs scheduling
2016-10-24 14:32:44,180 +0000 log_level=INFO, pid=60713, tid=Thread-6, file=thread_pool.py, func_name=_run, code_line_no=261 | Thread work_queue_size=0
2016-10-24 14:32:44,179 +0000 log_level=INFO, pid=60713, tid=Thread-2, file=scheduler.py, func_name=get_ready_jobs, code_line_no=100 | Get 1 ready jobs, next duration is 119.998499, and there are 1 jobs scheduling
2016-10-24 14:30:44,216 +0000 log_level=INFO, pid=60713, tid=Thread-124, file=mscs_storage_table_data_collector.py, func_name=_do_collect_data, code_line_no=84 | [stanza_name="LinuxsyslogVer2v0" account_name="acctname" table_name="LinuxsyslogVer2v0"] query_entities_page_size=1000 event_cnt_per_item=100 query_end_time_offset=60.0
2016-10-24 14:30:44,216 +0000 log_level=INFO, pid=60713, tid=Thread-124, file=mscs_storage_table_data_collector.py, func_name=_do_collect_data, code_line_no=79 | [stanza_name="LinuxsyslogVer2v0" account_name="acctname" table_name="LinuxsyslogVer2v0"] The filter is "(Timestamp ge datetime'2016-10-24T12:41:44Z') and (Timestamp lt datetime'2016-10-24T14:29:44Z')".
2016-10-24 14:30:44,216 +0000 log_level=INFO, pid=60713, tid=Thread-124, file=mscs_storage_service_factory.py, func_name=_set_proxy, code_line_no=68 | [stanza_name="LinuxsyslogVer2v0" account_name="acctname" table_name="LinuxsyslogVer2v0"] proxy is disabled.
2016-10-24 14:30:44,215 +0000 log_level=INFO, pid=60713, tid=Thread-124, file=mscs_storage_table_data_collector.py, func_name=_do_collect_data, code_line_no=68 | [stanza_name="LinuxsyslogVer2v0" account_name="acctname" table_name="LinuxsyslogVer2v0"] Finishing pre-process checkpoint.
2016-10-24 14:30:44,215 +0000 log_level=INFO, pid=60713, tid=Thread-124, file=mscs_storage_table_data_collector.py, func_name=_pre_process_ckpt, code_line_no=152 | [stanza_name="LinuxsyslogVer2v0" account_name="acctname" table_name="LinuxsyslogVer2v0"] The entities between 2016-10-24T10:51:44Z and 2016-10-24T12:41:44Z are all collected, updating the checkpoint.
2016-10-24 14:30:44,215 +0000 log_level=INFO, pid=60713, tid=Thread-124, file=mscs_storage_table_data_collector.py, func_name=_pre_process_ckpt, code_line_no=145 | [stanza_name="LinuxsyslogVer2v0" account_name="acctname" table_name="LinuxsyslogVer2v0"] The checkpoint status=all_done.
2016-10-24 14:30:44,215 +0000 log_level=INFO, pid=60713, tid=Thread-124, file=mscs_storage_table_data_collector.py, func_name=_do_collect_data, code_line_no=65 | [stanza_name="LinuxsyslogVer2v0" account_name="acctname" table_name="LinuxsyslogVer2v0"] Starting to pre-process checkpoint.
2016-10-24 14:30:44,215 +0000 log_level=INFO, pid=60713, tid=Thread-124, file=mscs_storage_table_data_collector.py, func_name=collect_data, code_line_no=54 | [stanza_name="LinuxsyslogVer2v0" account_name="acctname" table_name="LinuxsyslogVer2v0"] Starting to collect data.
2016-10-24 14:30:44,214 +0000 log_level=INFO, pid=60713, tid=Thread-123, file=mscs_storage_dispatcher.py, func_name=_dispatch_tasks, code_line_no=122 | [stanza_name="LinuxsyslogVer2v0" account_name="acctname" table_list="LinuxsyslogVer2v0"] The number of qualified_storage is 1
2016-10-24 14:30:44,214 +0000 log_level=INFO, pid=60713, tid=Thread-123, file=mscs_storage_table_dispatcher.py, func_name=_get_storage_info_list, code_line_no=63 | [stanza_name="LinuxsyslogVer2v0" account_name="acctname" table_list="LinuxsyslogVer2v0"] The qualified table_list=[u'LinuxsyslogVer2v0']
2016-10-24 14:30:44,214 +0000 log_level=INFO, pid=60713, tid=Thread-123, file=mscs_storage_table_dispatcher.py, func_name=_get_storage_info_list, code_line_no=57 | [stanza_name="LinuxsyslogVer2v0" account_name="acctname" table_list="LinuxsyslogVer2v0"] The table_list=[u'LinuxCpuVer2v0', u'LinuxDiskVer2v0', u'LinuxMemoryVer2v0', u'LinuxsyslogVer2v0', u'MemoryVer2v0', u'SchemasTable', u'WADDiagnosticInfrastructureLogsTable', u'WADMetrics', u'WADMetrics', u'WADMetrics', u'WADMetrics', u'WADPerformanceCountersTable', u'WADWindowsEventLogsTable']
2016-10-24 14:30:44,180 +0000 log_level=INFO, pid=60713, tid=Thread-123, file=mscs_storage_service_factory.py, func_name=_set_proxy, code_line_no=68 | [stanza_name="LinuxsyslogVer2v0" account_name="acctname" table_list="LinuxsyslogVer2v0"] proxy is disabled.
2016-10-24 14:30:44,180 +0000 log_level=INFO, pid=60713, tid=Thread-123, file=mscs_storage_table_dispatcher.py, func_name=_log_compiled_table_names, code_line_no=42 | [stanza_name="LinuxsyslogVer2v0" account_name="acctname" table_list="LinuxsyslogVer2v0"] The patterns=[u'LinuxsyslogVer2v0$']
2016-10-24 14:30:44,180 +0000 log_level=INFO, pid=60713, tid=Thread-123, file=mscs_storage_dispatcher.py, func_name=_dispatch_storage_list, code_line_no=85 | [stanza_name="LinuxsyslogVer2v0" account_name="acctname" table_list="LinuxsyslogVer2v0"] Starting to dispatch storage list.
2016-10-24 14:30:44,180 +0000 log_level=INFO, pid=60713, tid=Thread-5, file=mscs_storage_table_list_data_collector.py, func_name=collect_data, code_line_no=31 | [stanza_name="LinuxsyslogVer2v0" account_name="acctname" table_list="LinuxsyslogVer2v0"] Starting to get data from data_writer.
2016-10-24 14:30:44,179 +0000 log_level=INFO, pid=60713, tid=Thread-5, file=mscs_storage_table_list_data_collector.py, func_name=collect_data, code_line_no=27 | [stanza_name="LinuxsyslogVer2v0" account_name="acctname" table_list="LinuxsyslogVer2v0"] Starting to collect data.
2016-10-24 14:30:44,179 +0000 log_level=INFO, pid=60713, tid=Thread-5, file=mscs_storage_dispatcher.py, func_name=init, code_line_no=40 | [stanza_name="LinuxsyslogVer2v0" account_name="acctname" table_list="LinuxsyslogVer2v0"] worker_threads_num=10
2016-10-24 14:30:44,179 +0000 log_level=INFO, pid=60713, tid=Thread-5, file=ta_data_collector.py, func_name=index_data, code_line_no=122 | [stanza_name="LinuxsyslogVer2v0" account="acctname"] Start indexing data for checkpoint_key=LinuxsyslogVer2v0acctname
2016-10-24 14:30:44,178 +0000 log_level=INFO, pid=60713, tid=Thread-2, file=scheduler.py, func_name=get_ready_jobs, code_line_no=100 | Get 1 ready jobs, next duration is 119.999494, and there are 1 jobs scheduling
2016-10-24 14:29:52,377 +0000 log_level=INFO, pid=60713, tid=Thread-4, file=thread_pool.py, func_name=_run, code_line_no=261 | Thread work_queue_size=0
2016-10-24 14:29:52,377 +0000 log_level=INFO, pid=60713, tid=Thread-4, file=ta_data_collector.py, func_name=index_data, code_line_no=130 | [stanza_name="LinuxsyslogVer2v0" account="acctname"] End of indexing data for checkpoint_key=LinuxsyslogVer2v0_acctname
2016-10-24 14:29:52,376 +0000 log_level=INFO, pid=60713, tid=Thread-4, file=mscs_storage_table_list_data_collector.py, func_name=collect_data, code_line_no=61 | [stanza_name="LinuxsyslogVer2v0" account_name="acctname" table_list="LinuxsyslogVer2v0"] Retrieve the remain data from data_writer.
2016-10-24 14:29:49,375 +0000 log_level=INFO, pid=60713, tid=Thread-121, file=mscs_storage_dispatcher.py, func_name=_dispatch_storage_list, code_line_no=88 | [stanza_name="LinuxsyslogVer2v0" account_name="acctname" table_list="LinuxsyslogVer2v0"] Finished dispatching storage list.
2016-10-24 14:29:49,340 +0000 log_level=INFO, pid=60713, tid=Thread-122, file=mscs_storage_table_data_collector.py, func_name=collect_data, code_line_no=57 | [stanza_name="LinuxsyslogVer2v0" account_name="acctname" table_name="LinuxsyslogVer2v0"] Finish collecting data.
2016-10-24 14:28:44,179 +0000 log_level=INFO, pid=60713, tid=Thread-7, file=thread_pool.py, func_name=_run, code_line_no=261 | Thread work_queue_size=0
2016-10-24 14:28:44,178 +0000 log_level=INFO, pid=60713, tid=Thread-2, file=scheduler.py, func_name=get_ready_jobs, code_line_no=100 | Get 1 ready jobs, next duration is 119.999480, and there are 1 jobs scheduling
... View more
08-11-2016
09:00 AM
1 Karma
Going to answer my own question since we got it working. I think it was because the permissions were granted after adding the account to Splunk.
Fixed by:
Removed Inputs config
Removed account config
Added account config
Added inputs config
Kept the certificate configuration as-is.
... View more
07-19-2016
06:16 PM
Klaxdal,
Your answer should really be its own question and answer. It solved my issue with Cisco IPS with Splunk 6.4. One thing to note is I had to restart Splunk twice for it to start working, the first restart it threw an error, but the second restart it worked.
Error after first restart
ERROR - Exception thrown in sdee.get(): Traceback (most recent call last): File "/opt/splunk/etc/apps/Splunk_TA_cisco-ips/bin/get_ips_feed.py", line 117, in run sdee.get() File "/opt/splunk/etc/apps/Splunk_TA_cisco-ips/bin/pysdee/pySDEE.py", line 211, in get self._request(params, **kwargs) File "/opt/splunk/etc/apps/Splunk_TA_cisco-ips/bin/pysdee/pySDEE.py", line 163, in _request data = urllib2.urlopen(req) File "/opt/splunk/lib/python2.7/urllib2.py", line 154, in urlopen return opener.open(url, data, timeout) File "/opt/splunk/lib/python2.7/urllib2.py", line 437, in open response = meth(req, response) File "/opt/splunk/lib/python2.7/urllib2.py", line 550, in http_response 'http', request, response, code, msg, hdrs) File "/opt/splunk/lib/python2.7/urllib2.py", line 475, in error return self._call_chain(*args) File "/opt/splunk/lib/python2.7/urllib2.py", line 409, in _call_chain result = func(*args) File "/opt/splunk/lib/python2.7/urllib2.py", line 558, in http_error_default raise HTTPError(req.get_full_url(), code, msg, hdrs, fp) HTTPError: HTTP Error 400: Bad Request
... View more
07-07-2016
11:47 AM
1 Karma
No permission to fetch Azure AD Audit data. There might be some delay after changing the application permissions.
No permission to fetch Sharepoint Online Audit data. There might be some delay after changing the application permissions.
No permission to fetch Exchange Online Audit data. There might be some delay after changing the application permissions.
And yes, we have verified that the permissions below exist. Service Status and Operational Messages work, just not the rest. Any ideas?
http://docs.splunk.com/Documentation/AddOns/released/MSCloudServices/ConfigureappinAzureAD#Create_an_application_in_Microsoft_Azure_AD
... View more
06-28-2016
05:34 AM
20 Karma
Posting my own answer in-case someone else runs into this bug. No more errors when lookup filename is modified on the search head. This happens because the default is referencing the full path, and on a index cluster the app is located in slave-apps and not apps.
Contents of splunk/etc/apps/Splunk_TA_microsoft-sqlserver/default/transforms.conf
[sqlserver_host_dbserver_lookup]
filename = $SPLUNK_HOME/etc/apps/Splunk_TA_microsoft-sqlserver/lookups/sqlserver_host_dbserver_lookup.csv
Contents of new splunk/etc/apps/Splunk_TA_microsoft-sqlserver/local/transforms.conf
[sqlserver_host_dbserver_lookup]
filename = sqlserver_host_dbserver_lookup.csv
... View more
06-28-2016
05:31 AM
8 Karma
How do I resolve this error?
[idx1] The lookup table 'sqlserver_host_dbserver_lookup' does not exist. It is referenced by configuration 'mssql:execution:dm_exec_query_stats'.
Environment:
Splunk 6.4.2
Indexer Cluster
Splunk Add-on for Microsoft SQL Server 1.2.0
... View more
06-14-2016
05:27 AM
Thanks it worked for me too, Splunk should really update the app to fix this issue, if they want users to move to latest versions their supported apps should be compatible.
... View more
06-10-2016
06:41 AM
Is it possible to pull more than 1000 rows? I see in your code you have it limited to 1000 per request. This is a problem if you are attempting to use the app to pull event logs from Azure as you could easily exceed this volume even at short polling intervals.
... View more
05-27-2016
11:03 AM
1 Karma
Is it on a roadmap to pull Azure Security Center logs? They are stored as a blob in a storage account.
... View more
05-27-2016
10:59 AM
From Jason Conger: Try clearing the checkpoint. To do this, stop the Splunk instance where the Azure add-on is running and type the following at the command line:
$SPLUNK_HOME/bin/splunk clean inputdata AzureStorageTable
This worked for me.
... View more
05-12-2016
09:48 AM
Why is it even getting to line 304 in AzureStorageTable.py? There is no marker but its logging that there is a marker.
if marker is not None:
# If we have a marker, then we just pick up there.
logging.debug("Marker found for table %s: %s" % (table_name, marker))
dateTimeStart = dateutil.parser.parse(marker)
ValueError: Unknown string format
raise ValueError("Unknown string format")
File "/opt/splunk/etc/apps/TA-Azure/bin/dateutil/parser.py", line 395, in parse
return DEFAULTPARSER.parse(timestr, **kwargs)
File "/opt/splunk/etc/apps/TA-Azure/bin/dateutil/parser.py", line 1008, in parse
dateTimeStart = dateutil.parser.parse(marker)
File "/opt/splunk/etc/apps/TA-Azure/bin/AzureStorageTable.py", line 307, in do_run
do_run()
File "/opt/splunk/etc/apps/TA-Azure/bin/AzureStorageTable.py", line 429, in <module>
Traceback (most recent call last):
AzureStorageTable:306 - Marker found for table WADWindowsEventLogsTable: None
AzureStorageTable:285 - Overriding dateTimeStart. New value = '2016-05-06 00:00:00'
AzureStorageTable:280 - dateTimeStart = '2016-05-10T12:31:03.393043'
AzureStorageTable:402 - XML: 'table_name' -> 'WADWindowsEventLogsTable'
AzureStorageTable:398 - XML: found param 'table_name'
AzureStorageTable:402 - XML: 'storage_account' -> 'REDACTED'
AzureStorageTable:398 - XML: found param 'storage_account'
AzureStorageTable:402 - XML: 'sourcetype' -> 'azure:storage:table'
AzureStorageTable:398 - XML: found param 'sourcetype'
AzureStorageTable:402 - XML: 'select_string' -> 'RawXml,Timestamp'
AzureStorageTable:398 - XML: found param 'select_string'
AzureStorageTable:402 - XML: 'pollingInterval' -> '60'
AzureStorageTable:398 - XML: found param 'pollingInterval'
AzureStorageTable:402 - XML: 'limit' -> '1000'
AzureStorageTable:398 - XML: found param 'limit'
AzureStorageTable:402 - XML: 'index' -> 'wineventlog'
AzureStorageTable:398 - XML: found param 'index'
AzureStorageTable:402 - XML: 'host' -> 'REDACTED'
AzureStorageTable:398 - XML: found param 'host'
AzureStorageTable:402 - XML: 'dateTimeStart' -> '2016-05-06'
AzureStorageTable:398 - XML: found param 'dateTimeStart'
AzureStorageTable:402 - XML: 'dateTimeColumn' -> 'Timestamp'
AzureStorageTable:398 - XML: found param 'dateTimeColumn'
AzureStorageTable:402 - XML: 'access_key' -> 'REDACTED'
AzureStorageTable:398 - XML: found param 'access_key'
AzureStorageTable:392 - XML: found stanza AzureStorageTable://REDACTED
AzureStorageTable:387 - XML: found configuration
... View more
05-10-2016
01:24 PM
Humm, still having the same errors. Whats the correct format for the date? I tried blank and 20160509T191536Z.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:03 AM
|
Karma given to
