Hello all, I am trying to blacklist some of the apps below. It doesn't matter what I do, the apps continue to get deployed to our QA search head. I had already checked whether these apps are being being deployed there via any other server class and they are not. According to the docs, the blacklists below should work, right? I tried different ways of blacklisting them with no success... I would greatly appreciate any help. Thank you. [serverClass:all_gensearch] filterType = whitelist whitelist.0 = spkprtsrch01*|spkqatsrch* restartSplunkd = false issueReload = true [serverClass:all_gensearch:app:SA-ldapsearch] [serverClass:all_gensearch:app:splunk_app_windows_infrastructure] [serverClass:all_gensearch:app:Splunk_TA_microsoft_ad] [serverClass:all_gensearch:app:Splunk_TA_microsoft_dns] [serverClass:all_gensearch:app:TA-maclookup] [serverClass:all_gensearch:app:TA-user-agents] [serverClass:all_gensearch:app:TA_cisco_cdr [serverClass:all_gensearch:app:Splunk_TA_nginx] blacklist.0 = spkqatsrch* [serverClass:all_gensearch:app:SA-nix] restartSplunkd = false [serverClass:all_gensearch:app:splunk_app_jenkins] blacklist.0 = spkqatsrch* [serverClass:all_gensearch:app:NetSkopeAppForSplunk] blacklist.0 = spkqatsrch* [serverClass:all_gensearch:app:TA-Zscaler_CIM] blacklist.0 = spkqatsrch* [serverClass:all_gensearch:app:duo_splunkapp] blacklist.0 = spkqatsrch* [serverClass:all_gensearch:app:zscalersplunkapp] blacklist.0 = spkqatsrch* [serverClass:all_gensearch:app:TA-Zscaler_CIM] blacklist.0 = spkqatsrch* [serverClass:all_gensearch:app:GSuiteForSplunk] blacklist.0 = spkqatsrch* ... View more

Hello everyone, I am trying to put a table view together with no luck. The view is rather simple in theory but I cannot render it using SPL. I'd like to display the values of OS BY ip_address BY interface BY host. I would like them to be contained in one another from the most specific to the least (right to left). Using "values() by " won't give me the view I need. Ultimately, I wanted to show all rows for a field but only one for the common parent. I'd like to see something like the below. Sort of like a cascade effect. I'd appreciate any help!! Please, let me know if I am not being clear enough. Host | interface | ip_address | OS Host1 eth0 10.110.x.x linux windows OSX 10.110.x.x linux windows OSX 10.110.x.x linux windows OSX eth1 10.110.x.x linux windows OSX 10.110.x.x linux windows OSX 10.110.x.x linux windows OSX Host2 eth0 10.110.x.x linux windows OSX 10.110.x.x linux windows OSX 10.110.x.x linux windows OSX eth1 10.110.x.x linux windows OSX 10.110.x.x linux windows OSX 10.110.x.x linux windows OSX ... View more

Hello everyone, I am facing this issue where for some reason audit logs are not being ingested into Splunk. The app lives on a Heavy Forwarder. Both Sign-In and Audit logs are set and have the same credentials. I triple-checked their input configurations and all seems correct. Sign-in logs are now being ingested as expected, unlike the audit logs. They are all configured with a 300 second interval and with the default range for old logs. The errors I see are: "python /opt/splunk/etc/apps/TA-MS-AAD/bin/MS_AAD_audit.py" HTTPError: 400 Client Error: Bad Request for url: https://graph.microsoft.com/beta/auditLogs/directoryAudits?$orderby=activityDateTime&$filter=activityDateTime+ge+2019-09-01T05%3a34%3a03.6793713Z&$skiptoken=b33039c65e2552b5b80f2ea46b788b5e_859000 I was seeing some 429, which I found out had to do with API throttling but now that I have it set to 300 seconds I don't seem to be getting those anymore: -0400 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/TA-MS-AAD/bin/MS_AAD_signins.py" HTTPError: 429 Client Error: for url: https://graph.microsoft.com/beta/auditLogs/signIns?$orderby=createdDateTime&$filter=createdDateTime+ge+2019-09-18T10:54:58.413607Z+and+createdDateTime+le+2019-09-18T11:14:58.413607Z Have any of you experienced something similar with this app? I am super stuck and have no idea what is going on... I would appreciate any help! 😉 Thanks, Yan ... View more