Hi, I am having an issue that the Microsoft 0365 Reporting Add-On continues to stop working. We found that usually a restart of the input in the WebUI fixes the issue. Now I was wondering if it possible to restart those inputs through an API call. I found the command that Splunk performs when you disable the Inputs in the Add-On to be from tine internal logs:     admin [22/Jul/2020:09:49:19.674 -0400] "POST /servicesNS/nobody/TA-MS_O365_Reporting/data/inputs/ms_o365_message_trace/ms_o365_message_trace/disable HTTP/1.1"     I have tried in powershell different variations of this command below but didn't have any luck so far. Is possible to call these WebUI commands through an API command ?     Invoke-Restmethod -Uri http://localhost:8088/servicesNS/nobody/TA-MS_O365_Reporting/data/inputs/ms_o365_message_trace/ms_o365_message_trace/disable -Method POST Invoke-Restmethod : {"text":"The requested URL was not found on this server.","code":404} At line:1 char:1 + Invoke-Restmethod -Uri http://localhost:8088/servicesNS/nobody/TA-MS ... + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~   Thank you, Oliver ... View more

Hey guys, has anyone integrated MS Teams data into Splunk? I am trying to find information on how many teams meetings are being held, how many users are in a meeting etc. Has anyone integrated that data successfully ? I do have the Azure Add-On, Microsoft Cloud Services Add-On and O365 Add-On installed but none of these Add-Ons give me any Teams details. Oliver ... View more

Hi, I have lately seen an issue that some scheduled alerts that contain attachments seem to get emailed to me one hour later than scheduled. I assume this has to do with volume of the alerts and searches scheduled but I haven't been to able to nail it down. When I look in the metadata for information about the delayed scheduled search it does show that it ran at the scheduled time, however the email alert often arrives exactly one hour later in my inbox. Has anyone experience with this kind of issue? Oliver ... View more

Hi, I am having an issue when we are trying to extracts fields at the Heavy Forwarder level. We are in a shared Cloud Environment but some Heavy Forwarders are local, so we want these HFs do the field extraction, however it doesn't seem to work. I created a transforms.conf and props.conf and when I tested it on my local Splunk instance without a Heavy Forwarder it does work: Props.conf: ## Custom Extractions Meraki ## TRANSFORMS-Logtype=Logtype TRANSFORMS-pattern=pattern TRANSFORMS-security_event_dtl=security_event_dtl TRANSFORMS-message=message TRANSFORMS-request=request TRANSFORMS-src=src TRANSFORMS-user=user ## Change user field ## EVAL-user = replace(user, "\\\,\\\20", ",") Transforms.conf ## Extract custom Meraki fields ## [Logtype] SOURCE_KEY = source REGEX = \\meraki\\(?<Logtype>\w+) [pattern] SOURCE_KEY = _raw REGEX = pattern:(?<pattern>.*) [security_event_dtl] SOURCE_KEY = _raw REGEX = security_event\s(?<security_event_dtl>\w+)\s\w+ [message] SOURCE_KEY = _raw REGEX = message:(?<message>.*) [request] SOURCE_KEY = _raw REGEX = request:\s\w+(?<request>.*) [src] SOURCE_KEY = _raw REGEX = client_ip='(?<src>.*) [user] SOURCE_KEY = _raw REGEX = CN=(?<user>.*?),OU From my understanding it should be possible to make these fields extractions at the Heavy Forwarder level , correct? I appreciate your help, Oliver ... View more