Hi. Was this resolved. Did you find the solution? ... View more

Hi. Did anyone found a solution? We are also interested in getting the windows intune audit and compliance logs + we would like End Point Manager Center devices, discovered apps and security settings etc. I found these Microsoft Docs: Device inventory: https://docs.microsoft.com/en-us/mem/intune/remote-actions/device-inventory Use Graphs API: https://docs.microsoft.com/en-us/graph/api/intune-devices-manageddevice-list?view=graph-rest-1.0 Article from MVP dated 2018: https://msendpointmgr.com/2018/10/10/export-microsoft-intune-audit-data-to-log-analytics-using-graph-api-and-azure-automation/   Anyone done this, or haveing info on spluink addon/apps to request this data? We might try the last link, to get the events into Azure Event Hub, and poll them there.   ... View more

Hi.   But it has passed the splunk app inspect, and is listed as supported on Splunk Enterprise 8.1 and 8.x I have a support ticket engineer looking into it now inside splunk.       ... View more

Thank you. Yes, what is strange it is listed as supported on Splunk platform 8.1 https://splunkbase.splunk.com/app/3584/#/details COMPATIBILITY Products: Splunk Enterprise, Splunk Cloud Splunk Versions: 8.1, 8.0  Platform: Platform Independent   We were on where Solarwinds AddOn worked fine: - AWS Linux - Splunk Enterprise 8.0.5 - Solarwinds addon version 1.1.0 Upgraded to: - AWS Linux - Splunk Enterprise 8.1 - Solarwinds addon version 1.1.0 So something must be wrong in the python code. This is the line 388 it complain about in our splunkd.log file: def validate(self, value, data): import datetime try: datetime.datetime.strptime(value, self._format) except ValueError, exc: error = 'Wrong datetime with format "%s": %s' % (self._format, str(exc)) self.put_msg(error) return False return True             ... View more

Same issue here as well. Unable to initialize modular input "solwarwinds_query" defined in the app "Splunk_TA_SolarWinds": Introspecting scheme=solwarwinds_query: script running failed (exited with code 1).. Splunk Enterprise 8.1 on Linux.   ... View more

Me too. WE just get our Splunk Cloud stack upgraded to version 8.0.2. Just wrote a support ticket to splunk to get an answer on how to get his Scripted SAML with Azure AD also working with Splunk Cloud Gateway. ... View more

Can it be a bug in this item from the release notes: Improved Azure AD data collection mechanism ... View more

Hi. It indeed use HTTPBasicAuth. Will this app be updated in time? [root@awpspkhf23h63 TA-MS_O365_Reporting]# vi bin/input_module_ms_o365_message_trace.py r = requests.get( microsoft_trace_url, proxies = proxies, auth=requests.auth.HTTPBasicAuth(microsoft_office_365_username, microsoft_office_365_password), headers={'Accept':'application/json'}) ... View more

I observed that version 3.5.3 need $SPLUNK_HOME variable set to work. Still I have issues on getting the firpower data connection events. I do get status and log. [splunk@vsrpdc1hfw01 bin]$ ./splencore.sh status status_id=1 status="Running" [splunk@vsrpdc1hfw01 bin]$ ./splencore.sh test 2018-10-05T23:31:28.806962 Diagnostics INFO Checking that configFilepath (estreamer.conf) exists 2018-10-05 23:31:28,813 Diagnostics INFO Check certificate 2018-10-05 23:31:28,813 Diagnostics INFO Creating connection 2018-10-05 23:31:28,813 Connection INFO Connecting to 10.95.251.87:8302 2018-10-05 23:31:28,813 Connection INFO Using TLS v1.2 2018-10-05 23:31:29,008 Diagnostics INFO Creating request message 2018-10-05 23:31:29,009 Diagnostics INFO Request message=0001000200000008ffffffff48900061 2018-10-05 23:31:29,009 Diagnostics INFO Sending request message 2018-10-05 23:31:29,009 Diagnostics INFO Receiving response message 2018-10-05 23:31:29,014 Diagnostics INFO Response message=KGRwMApTJ2xlbmd0aCcKcDEKSTQ4CnNTJ3ZlcnNpb24nCnAyCkkxCnNTJ2RhdGEnCnAzClMnXHgwMFx4MDBceDEzXHg4OVx4MDBceDAwXHgwMFx4MDhceDAwXHgwMFx4MDBceDAwXHgwMFx4MDBceDAwXHgwMFx4MDBceDAwXHgxM1x4ODhceDAwXHgwMFx4MDBceDA4XHgwMFx4MDBceDAwXHgwMFx4MDBceDAwXHgwMFx4MDBceDAwXHgwMFx4MWFceDBiXHgwMFx4MDBceDAwXHgwOFx4MDBceDAwXHgwMFx4MDBceDAwXHgwMFx4MDBceDAwJwpwNApzUydtZXNzYWdlVHlwZScKcDUKSTIwNTEKcy4= 2018-10-05 23:31:29,014 Diagnostics INFO Streaming info response 2018-10-05 23:31:29,014 Diagnostics INFO Connection successful [splunk@vsrpdc1hfw01 bin]$ Any idea? ... View more

Hi. I get this warnings in SPLUNK ES of a part of TA that we do not use. Any idea to get this turned off/disabled? Search peer [servername role indexer ] has the following message: Unable to initialize modular input "splunk_ta_aws_sqs" defined inside the app "Splunk_TA_aws": Unable to locate suitable script for introspection. ... View more