I have managed to resolve this on my OAUTH setup.   Error 401 is permissions error, this is from the official add on trouble shooting: The Splunk Add-on for Microsoft Office 365 requires ReportingWebService.Read.All. Verify this permission is selected, saved, and then granted within the Office 365 Management Activity API configuration on Azure Active Directory.   So in order to fix: In the Azure Portal, go to App registrations > All applications Select your application Select API Permissions Click Add a permission to display the Request API permission flyout page On the APIs my organization uses tab, select Office 365 Exchange Online On the flyout page, select Application permissions, and then click Add permissions The Reporting Web Service should now appear in the list of applications that your app requires permissions for Select Grant admin consent for "YourTenant" to consent to the permissions given to your app ... View more

For convenience, building on top of the previous response regarding the one-liner: The following is an example from the Monitor Windows data with PowerShell scripts - Splunk Documentation which allows for a multiline script using the [powershell] rather than [script] stanza [powershell://MSExchange_Health] script=. $SplunkHome/etc/apps/TA-Exchange-2010/powershell/health.ps1 Testing this at the moment with a custom PS script but doesn't fill me with supreme confidence when the official example references TA-Exchange-2010. ... View more

We had the same issue after upgrading to 8.2.4 Cleaning the browser cache solved the issue ... View more

There is no object field anywhere in the data for: index=_audit user=* action=indexes_edit This is even with searching against the last 90 days.  Why is that?   ... View more

I realise this is an old thread, but apparently still relevant! I have the same issue, (and have done in the past). Previously I asked Splunk support to fix it, and they did.... After about 2 weeks.  When I go to Indexes in the IDM, I can see all the indexes (60 of them) so the index.conf file must have been copied over to the IDM from our Search Head. However, the Office 365 app can only see the default 3, plus the one I previously asked support to make visible. When I run your query, I only see a few - what does this mean? I have admin rights already, so that cant be the issue. I even tried adding my user to every role available! ... View more

you have to specify in your regex expression at tranforms.conf what is the counters you don't want to index, otherwise, it will through away the entire sourcetype. I believe in your case, you have to create more than one regex expression to match the counters you want to drop from indexing. something like this: [typeyoursourcetypeherefor-vmware] TRANSFOMRS-Filterdatacount1=filtercount1 TRANSFOMRS-Filterdatacount1=filtercount2 transforms.conf [filtercount1] REGEX =(?msi)vmware:perf\S(change the regex to match the sourcetype/counter) DEST_KEY = queue FORMAT = nullQueue [filtercount2] REGEX =(?msi)vmware:perf\S(change the regex to match the sourcetype/counter) DEST_KEY = queue FORMAT = nullQueue ... View more

lets say i have user1 for which i need to check who has modified, i have many groups so i cannot give them, will the below syntax work for me. index=index_name (EventCode=4728 OR EventCode=4729) earliest=-5m latest=now | rename user1 AS "Actioned By", user1_first AS "First Name" user1_last AS "Last Name" name as "Action Taken" | rex mode=sed field="Account_Name" "s/CN=//g" | rex mode=sed field="Account_Name" "s/cn=//g" | rex mode=sed field="Account_Name" "s/,OU.*//g" | rex mode=sed field="Account_Name" "s/\\//g" | table "Actioned By" "First Name" "Last Name" Account_Name "Action Taken" Group_Name Account_Domain _time | sort - _time ... View more

thank you it really helped ... View more

Ok. Taken from documentation, https://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf ... i missed this directive... need to try. Event Log filtering Filtering at the input layer is desirable to reduce the total processing load in network transfer and computation on the Splunk platform nodes that acquire and processing Event Log data. whitelist = <list of eventIDs> | key=regex [key=regex] blacklist = <list of eventIDs> | key=regex [key=regex] whitelist1 = <list of eventIDs> | key=regex [key=regex] whitelist2 = <list of eventIDs> | key=regex [key=regex] whitelist3 = <list of eventIDs> | key=regex [key=regex] whitelist4 = <list of eventIDs> | key=regex [key=regex] whitelist5 = <list of eventIDs> | key=regex [key=regex] whitelist6 = <list of eventIDs> | key=regex [key=regex] whitelist7 = <list of eventIDs> | key=regex [key=regex] whitelist8 = <list of eventIDs> | key=regex [key=regex] whitelist9 = <list of eventIDs> | key=regex [key=regex] blacklist1 = <list of eventIDs> | key=regex [key=regex] blacklist2 = <list of eventIDs> | key=regex [key=regex] blacklist3 = <list of eventIDs> | key=regex [key=regex] blacklist4 = <list of eventIDs> | key=regex [key=regex] blacklist5 = <list of eventIDs> | key=regex [key=regex] blacklist6 = <list of eventIDs> | key=regex [key=regex] blacklist7 = <list of eventIDs> | key=regex [key=regex] blacklist8 = <list of eventIDs> | key=regex [key=regex] blacklist9 = <list of eventIDs> | key=regex [key=regex] ... clear! Need to try, later. Thanks. ps. this is documented under "Windows Event Log Monitor" however... not sure will work in a normal log file... i'll try. ... View more

Check your system resource usage while configuring inputs, app/add-on required suggested resources to work properly. ... View more

You cannot add PDFs, without first passing the events through a binary decoder. If you can find one that works from the CLI, then you can look at how Splunk handles *.zip files (google unarchive_cmd ) and do it the same way. As far as CSVs or XMLs, you can use INDEXED_EXTRACTIONS feature (google that). ... View more

When you copy over the old config files from your previous installation to the new one, splunk run a verification if the files are running on a different version and did not start the web, I am not really sure which files splunk uses to check it. The web is a very sensitive part of Splunk and you should be very carefully when you have to restore any config file from previous Splunk versions, because it is very hard to recover the Splunk web from the times I ran into issues. My suggestion to fix it, please reinstall the last Splunk Enterprise version, because it will be recover the web interface. Be carefully if you have to restore any file from previous installation and avoid to copy the entire folder, because it can cause the issues again. Copy the config files individually and check if Splunk will working properly. This is a manual process and time consuming, thus is necessary to avoid issues when you are copying the old config files to a new Splunk installation. ... View more

Come back and click Accept on your answer to close your question. ... View more

Have you checked your firewall settings ? Is port 9997 open on 192.168.0.12 ? Have you checked on both on the Windows Side and the Linux side ? Are you using SELinux ? ... View more

Hi, you can filter out the unwanted data using a regex in transforms.conf and stop that from indexing. https://answers.splunk.com/answers/59370/filtering-events-using-nullqueue-1.html here is an example, you will have to modify it as per your situation., ... View more

Yeah that would be the simplest way to disable them for now. if you are on a search head cluster you will have to do it on all the members and then to a rolling restart for these changes to get effected. ... View more

Hi Chris, I would suggest you to index it the regular way unless there is very huge amount of data which will impact your license, the only thing which i would take care is to ensure the time stamp which splunk is considering. Ensure that splunk is not using the indexed time which is mess up your data which is currently being indexed. In this scenario all the data will first hit the hot bucket and basing on the bucket settings this historic data will roll over to concerned buckets accordingly. ... View more

Refer below document: https://docs.splunk.com/Documentation/Splunk/7.2.6/DistSearch/Migratefromsearchheadpooling Happy Splunking!!! ... View more

Seems typo, field name should match, so if you rename you should use exact field name afterwards. | rename JSESSIONID as UserSessions | table UserSessions If you have space or special characters in the field name you should use double quotes. For example | rename JSESSIONID as "User Session IDs" | table "User Session IDs" ... View more

That is it. My hands are up. Not my fault....LOL....I hope Splunk is reading this or may be I should submit a load of enhancement requests I have piled up in my notes. ... View more

Hi, i tried to use your regex with regex101 and they do not match correctly. What you want, is a regex that captures everything up to the string you want to mask, and everything behind. Then, in the FORMAT field you use the first capture group, set your mask in the middle and use the secodn capture group. Try this: [record-anonymizer] REGEX = (?m)^(.*)record_number\\\=\d+(.*)$ FORMAT = $1record_number=##$2 DEST_KEY = _raw [first-name-anonymizer] REGEX = (?m)^(.*)shipping_first_name\\\=\w+(&.*)$ FORMAT = $1shipping_first_name=##$2 DEST_KEY = _raw [last-name-anonymizer] REGEX = (?m)^(.*)shipping_last_name\\\=\w+(&.*)$ FORMAT = $1shipping_last_name=##$2 DEST_KEY = _raw Greetings Tom ... View more

Nothing is required to be installed on ServiceNow side, but just an API account enabled in ServiceNow . (eg . splunk_access_account) then test this account from your remote server using CURL . (replace the values accordingly) curl -k username:password http://{xyzcompany}.service-now.com/table/{tableName}/{sys_id} Check the response and ensure your API account works and response is fetched. Then configure inputs.conf in your ServiceNow addon (or separate app of your own) in your HeavyForwarder or Collection Splunk system and pull a table (eg incident table) ... View more

Here you go https://regex101.com/r/yHxyYg/1 , it is working fine ... View more

Yeah I wasn't sure which I should post as the final answer since collectively there many that offered assistance. So I figured I would just summarize the ultimate fix in a post and mark as answered; thought it might make it easier for anyone who experiences this in the future to find what exactly fixed my issue of all the inputs received. Can you accept multiple post as the answer? I didn't try. ... View more

please contact Splunk Education for this ... View more