Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About bcatoe112
bcatoe112
Explorer
Member since:
06-07-2018
06-05-2020
Community Statistics
| Posts | 6 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 2 |
| Member Since | 06-07-2018 |
Activity Feed
- Got Karma for Version 1.1.3 does not give Message Trace Results when using "Continuously Monitor". 06-05-2020 12:49 AM
- Got Karma for Authentication "Tags". 06-05-2020 12:49 AM
- Posted Re: Version 1.1.3 does not give Message Trace Results when using "Continuously Monitor" on All Apps and Add-ons. 08-06-2018 04:02 AM
- Posted Re: Version 1.1.3 does not give Message Trace Results when using "Continuously Monitor" on All Apps and Add-ons. 08-06-2018 03:30 AM
- Posted Decrease Interval from 86400? on All Apps and Add-ons. 08-04-2018 05:47 AM
- Tagged Decrease Interval from 86400? on All Apps and Add-ons. 08-04-2018 05:47 AM
- Posted Version 1.1.3 does not give Message Trace Results when using "Continuously Monitor" on All Apps and Add-ons. 08-04-2018 04:09 AM
- Tagged Version 1.1.3 does not give Message Trace Results when using "Continuously Monitor" on All Apps and Add-ons. 08-04-2018 04:09 AM
- Posted Re: Version 1.1.0 doesn't get message trace on All Apps and Add-ons. 08-01-2018 03:20 AM
- Posted Authentication "Tags" on All Apps and Add-ons. 06-07-2018 07:58 AM
- Tagged Authentication "Tags" on All Apps and Add-ons. 06-07-2018 07:58 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 1 | |||
| 1 |
08-06-2018
04:02 AM
That actually worked! Deleting the input and re-creating it (with a new name) worked and it is now running searches in 1 hour increments from about 5 days ago. Thanks for the help!
... View more
08-06-2018
03:30 AM
Thanks for the reply. I tried that and i get the same results. After the initial bulk import, then setting it back to "continuously monitor" the logs returned "no messages returned", and the search date is set to 7-6-2018 once again. However in looking at the index the last indexed item was on 8/4 (when i did the bulk import).
2018-08-06 05:29:12,403 DEBUG pid=95026 tid=MainThread file=binding.py:new_f:71 | Operation took 0:00:00.002489
2018-08-06 05:29:12,403 DEBUG pid=95026 tid=MainThread file=base_modinput.py:log_debug:286 | Start date: 2018-07-06 23:51:38, End date: 2018-07-07 00:51:38
2018-08-06 05:29:12,404 DEBUG pid=95026 tid=MainThread file=base_modinput.py:log_debug:286 | Endpoint URL: https://reports.office365.com/ecp/reportingwebservice/reporting.svc/MessageTrace?$filter=StartDate eq datetime'2018-07-06T23:51:38Z' and EndDate eq datetime'2018-07-07T00:51:38Z'
2018-08-06 05:29:12,404 INFO pid=95026 tid=MainThread file=setup_util.py:log_info:114 | Proxy is not enabled!
2018-08-06 05:29:12,409 DEBUG pid=95026 tid=MainThread file=connectionpool.py:_new_conn:809 | Starting new HTTPS connection (1): reports.office365.com
2018-08-06 05:29:13,270 DEBUG pid=95026 tid=MainThread file=connectionpool.py:_make_request:400 | https://reports.office365.com:443 "GET /ecp/reportingwebservice/reporting.svc/MessageTrace?$filter=StartDate%20eq%20datetime'2018-07-06T23:51:38Z'%20and%20EndDate%20eq%20datetime'2018-07-07T00:51:38Z' HTTP/1.1" 200 216
2018-08-06 05:29:13,273 DEBUG pid=95026 tid=MainThread file=base_modinput.py:log_debug:286 | No messages returned. Setting max date to 2018-07-06 23:56:38
... View more
08-04-2018
05:47 AM
Why is the minimum interval set at 1 day (86400 seconds). Frequently when visiting the Tenable App dashboard the "Vulnerabilities today" is 0 as it has not yet pulled yet for that day. Can we decrease the interval to have it pull more than once a day? i have tried to set it below 86400 but it says it has to be greater than that.
... View more
08-04-2018
04:09 AM
1 Karma
Every since we upgraded the O365 Reporting app to 1.1.0 we have not been getting Message Trace Logs. I upgraded this morning to 1.1.3, and still the same thing. The error below shows in the logs when it tries to search.
For the below example i set it to Continuously Monitor, with a start date of 8/3/2018. However when the query runs it sets the start date to 7/5. I have tried multiple combinations of dates and the start and end date are always 7/5 when set to continuously monitor.
2018-08-04 06:06:23,695 DEBUG pid=13857 tid=MainThread file=connectionpool.py:_new_conn:809 | Starting new HTTPS connection (1): reports.office365.com
2018-08-04 06:06:24,454 DEBUG pid=13857 tid=MainThread file=connectionpool.py:_make_request:400 | https://reports.office365.com:443 "GET /ecp/reportingwebservice/reporting.svc/MessageTrace?$filter=StartDate%20eq%20datetime'2018-07-05T00:31:38Z'%20and%20EndDate%20eq%20datetime'2018-07-05T01:31:38Z' HTTP/1.1" 200 216
What i did notice is that if i select "Index once" in the config and specify a time period, it pulls logs in fine. However when switched back to "Continuously Monitor" it breaks again. Any ideas?
... View more
08-01-2018
03:20 AM
Same issue here, after upgrading we no longer are getting message trace logs. Has anyone been able to fix this?
... View more
06-07-2018
07:58 AM
1 Karma
Out of the box the "Login Activity" dashboard does not display any data. The OOTB search is looking for a tag of "Authentication" however no events have that tag.
sourcetype=ms:o365:management tag=authentication action=failure
Is this something that is expected to be built after installation, or did something get missed when installing the application?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
