Adding the edit to mention that I figured out that in the inputs.conf file you can use a cron schedule for the "interval" parameter.  It's the TA UI that does not accept a cron value, which I think should be changed.  I see a new TA version was released in July, maybe it already accepts cron. Anyways, my solution was to spread the inputs across the following crons: 0-59/5 * * * * 1-59/5 * * * * 2-59/5 * * * * 3-59/5 * * * * 4-59/5 * * * * My assignment to these crons was based on which subscriptions send back the most data. So far I am not receiving any 429 Client Error. Regards, Andrew ... View more

what did you do to fix the issue?  ... View more

Thank you! Worked for me! ... View more

Azure AD sign-in logs -> Azure event hub -> Splunk.   Just make sure you're using v4.1.3 of the Splunk Add-on for Microsoft Cloud Services.   Prior versions didn't handle event hubs properly. https://splunkbase.splunk.com/app/3110/ ... View more

If there are still issues like these on 3.2.4, I suggest to: clear out the TA-dmarc/local/ directory (which resets the config back to default) if that doesn't work: remove the entire add-on from the heavy forwarder and reinstall This seems to solve a number of reports where there were still Python2/3 related issues resulting in TA-dmarc: Introspecting scheme=<something> : script running failed (exited with code 1). I haven't been able to reproduce any of these weird errors. A clean install on any Splunk version Just Works. I also tested some upgrade scenarios but haven't been able to find any issues there either. So I can't offer any direct solution, except for the "delete and reinstall" workaround above.   ... View more

Thanks was looking for this solution too! ... View more

When trying to index at once last 30 days it also doesn't do anything. Tried to go to URL from debug log - it returns XML with some message trace data. ... View more

Hi, I checked this now. It is working. Anyway, compatibility will be apprerciated 🙂 ... View more

Problem no longer exists after upgrading to 2.0.0 for me. ... View more

I had this issue with 1.0.3 as well. I contacted MS Support and was told: For sign-ins to Azure services, we expect latency of up to 5 minutes. From the o365 side, they allow latency of up to 24 hours, but say delays should be considerably shorter. Basically, Signin logs aren't available via API in chronological order, but the Signin Time is accurate. So you may get: Event 1 Event 4 Event 2 Event 3 Because the app uses the checkpoint time of the newest event, you'd lose Events 2 and 3 in this scenario if the scripted input ran between Event 4 being available via API and Event 3 being available. What I did was update the python code to search from the checkpoint date/time to 10 minutes ago. This means that my log data is always 10 minutes behind, but I can live with that. FYI - I also noticed a bug where the graph URL is using ge (greater than or equal to) instead of gt (greater than). This caused the newest event from each run to be duplicated. If you had several runs with no new data, that event could get duplicated many times. My updated portion of the python script is as follows: # Added by George to account for events not being made available via API in chronological order # toDateTime = (datetime.datetime.utcnow() - datetime.timedelta(minutes=10)).strftime('%Y-%m-%dT%H:%M:%SZ') url = "https://graph.microsoft.com/beta/auditLogs/signIns?$orderby=createdDateTime&$filter=createdDateTime+gt+%s+and+createdDateTime+lt+%s" % (query_date, toDateTime) #url = "https://graph.microsoft.com/beta/auditLogs/signIns?$orderby=createdDateTime&$filter=createdDateTime+ge+%s" % query_date # # Done with George Additions I did not notice missing audit events with 1.0.3, but I'll be validating that data this week since I just upgraded the App to 1.1.0. ... View more

Thanks, now it seems to be ok! ... View more

Just a quick comment that this is now available in the InfoSec app version 1.4.0 on Splunkbase: https://splunkbase.splunk.com/app/4240/ ... View more

i am facing the same issue? anyone have fix for above issue? ... View more

Try to add file props.conf with the following content (in etc/apps/TA-MS_O365_Reporting/local/): [ms:o365:reporting:messagetrace] TZ = Zulu ... View more