could be a bug. One thing i forgot to mention, make sure you have data in that sourcetype. If teh sourcetype has no data in the last week or month (forgot which one) then it wont be visible. Can you confirm the same? ... View more

Sourcetypes are tied to data collection. 1- If it is mod input (built in Addon builder) it automatically shows on the list 2- If it is data indexed by Splunk core such HEC or syslog, you will need to import it by clicking on "import from splunk" button under "add sample data tab". Once you have imported it, it becomes visible to you in Addon builder so that you can apply knowledge ( field extraction and cim mapping) as part of the add-on 3- if you want to add file monitoring in addon, click on "upload from file", it becomes visible to you in Addon builder so that you can apply knowledge ( field extraction and cim mapping) as part of the add-on This has become a common question we get, we will improve the UX to make it more clear in furture but hope this answers your question. ... View more

Ok so now it makes more sense. sounds like sys_updated_on is not returned by the API which could be permission. to find out more, You can run https://.service-now.com/.do?JSONv2&sysparm_query=sys_created_on>=2016-01-01+00:00:00^ORDERBYsys_created_on&sysparm_record_count=50 mysinstance.service-now.com per the troubleshooting doc http://docs.splunk.com/Documentation/AddOns/released/ServiceNow/Troubleshooting and see if those events are returned with that field included. If not, then SNOW admins needs to investigate why. ... View more

Not yet scheduled but it might work out of the box using the same release of Add-on and update set. ... View more

what kind of SSL authentication your proxy requires? I think the problem is due to the fact the the proxy certificate are not trusted on the HWF machine where the add-on runs. I would start by adding the CA root to the trusted store on that machine. ... View more

The above helper functions are to index the data. If you want your alert action to log info to internal logs, you can use helper.log_info("my info message") helper.log_error("my error message") There are example of helper.log_info in commented area that you can leverage ... View more

yes - helper.get_param("abc") would allow you to use static or dynamic values passed from search results triggering the alert. ... View more

Looks like it could be a proxy issue. Did you check if you can get to the internet without proxy? Try to telnet from cmd or check browser setting on HWF. ... View more

are you using 2.6.2 version of the app? when you type index=sfdc is there anything returned? ... View more

What errors are you getting in index=_internal? I would suggest to file a support ticket and upload diag on that ticket for us to get a closer look. Hard to tell what the problem is without the log files. ... View more

Should not. hasn't been tested on cluster. ... View more

updated the doc but yeah you can ignore. Thank you for bringing this to my attention ... View more

All authentication can be ingested using the O365 Management Activity input. You just need to select the Azure Authentication from that input. This is technically ingesting all Azure authentication beyong O365 apps. You can use the Azure audit input for Azure portal audit related. ... View more

yes thats the use case we support. The App does not even need to be build by AoB for you to run validation/pre-vetting. ... View more

what do you get when you run: index=_internal validation source="*builder_ta_builder.log" error ... View more

i see access denied issue. 1- Can you first start by running App certification (only) by removing "Best Practice", "CIM extraction" and "Field Extraction" and let us know if it goes through successfully 2- did you add any additional files to the add-on folder from outside of add-on builder (copy paste or edit in windows explorer). I am thinking that some of these files might not have right access by splunkd user which is causing permission issue. ... View more

Does your browser have any proxy settings to access to the internet? Also, do you get errors when you run: index=_internal validation source="*splunk_app_addon-builder_ta_builder.log" ... View more

have you tried without the global proxy in launch.conf and set this is up only in Add-on? Ive seen issues when you set it up in both. ... View more

You cant have two apps with same app id and renaming the box app id can break things. I would suggest to install it on a seperate HFW and configure from there until we come up with multiple account support in this add-on ... View more

In the MS Cloud Services Add-on, you have the ability to ingest data from the MS O365 management activity API: https://msdn.microsoft.com/en-us/office-365/office-365-management-activity-api-reference This should give you access to all sorts of audit events related Exchange online. ... View more