Hi @Na_Kang_Lim  @livehybrid  is 100% right, TrackMe V1 is out of date and unsupported since more than 2 years now, therefore I wouldn't respond on this. Please consider upgraded to TrackMe V2: https://docs.trackme-solutions.com there are options to migrate from V1 to V2 (https://docs.trackme-solutions.com/latest/migration_trackmev1.html) but I would suggest to consider a fresh configuration instead rather than migrating stuffs. ... View more

Hi @florianlapolla  Apologises for the late answer - time is a previous thing I am lacking a lot nowadays. This sounds like this might be possible (but seems controlversial however): https://powerusers.microsoft.com/t5/Building-Flows/Channel-Teams-mention-in-Adaptive-Cards/m-p/1444535/highlight/true#M162055 I need to think how I could test, I don't have an active Teams I can access to with real teams right now (I got a team but I am all alone in the World!) What do you think form this thread? ... View more

HI @Schroeder  Thanks for sharing - gotcha, I had done experiences earlier and I have an Altassian env which I understand provides me with the same product (ITSM) However I couldn't get the regular alert action to fail so I need to review it  Likely I would need to add another alert action due to the changes in the structure but I need to review this - it's on my list 😉 ... View more

If I am understanding it well it's called "JIRA Service Management"  Will give it a try ... View more

Hi @Schroeder  Hum, right sounds about weird, there are different JIRA products and somehow things are a bit confusing. The answer from the API when saying "not on the screen"  Usually indicates that the field needs to be set on the screen in JIRA (for that project), but those mentioned are usually mandatory fields so that is confusing. It seems to be specific to either the JIRA product you're having or the type of the project, I see a reference to: https://developer.atlassian.com/cloud/jira/service-desk/rest/ Currently, the API url is hard coded in the Python backend, so it would need some modifications to be something configurable (but not undoable) I need to better understand what we are dealing with, if you come to an issue creation that works for your product then let me know how this looks like? Trying to investigate what this REST API means ... View more

Hi @justynap_ldz  Have you checked the logs? https://ta-ms-teams-alert-action.readthedocs.io/en/latest/configuration.html#   ... View more

Hi @AM_V  Replying in Git: https://github.com/guilhemmarchand/TA-jira-service-desk-simple-addon/issues/133 ... View more

Hi @cit_student  Hum right, that looks suspiscious, shouldn't happen, the only condition I could think of would be if TrackMe cannot access any longer to this data source when running the tracker, such as adding a blocklist, but then it would be automatically excluded by the UI. Another option would be that this data scope is excluded via the top level macro running in the tracker. Can you test the following: - note the priority and other settings on this data source (it will be logged in the audit changes in anyway in the next step) - Via the UI, delete temporary the data source (not permanently) - Run the short term tracker, if the data source generated data in the past 4 hours it should be re-created (if earlier than that and up to 24 hours you can run the long term tracker) - Check that the entity has been re-created in TrackMe Guilhem ... View more

@cit_student  When you click on the "search" button in the entity Window, this opens a search with the exact constraint from the entity (depending on how it was built), then check it out. If trackMe says it has no data for it, it is extemely likely it is the case and you are not comparing the exact same thing. (think that by default the entity is the index + sourcetype) Guilhem ... View more

Hi @SamHTexas  Please have a careful at the following documentation tutorials: - https://trackme.readthedocs.io/en/latest/configuration.html - https://trackme.readthedocs.io/en/latest/userguide.html#your-first-steps-with-trackme You have as well my talk from .conf: TrackMe .conf 2021 video: https://conf.splunk.com/files/2021/recordings/TRU1548B.mp4 TrackMe .conf 2021 slides: https://conf.splunk.com/files/2021/slides/TRU1548B.pdf When you say: "on my Cluster Master where most of my apps are located" I guess perhaps you meant the monitoring console node? The cluster master is not a right candidate, and you should not deploy here any third party application other than base configuration apps, a proper candidate for TrackMe is either a dedicated search head, a search head cluster or the monitoring console host. Make sure you satisfy with the app dependencies too: https://trackme.readthedocs.io/en/latest/deployment.html#dependencies Guilhem ... View more

Hi @cit_student  You might be confused by the reason why TrackMe is complaining about these data sources, data sampling is a different concept from the tracking of latency and delay. You can check: - the status tab when you click on the data source table - the Smart Status report when you click on the data source table, then Smart Status Which is going to tell the reason why TrackMe is complaining about it. The data_last_time_seen represents the latest _time (so the latest event) seen in the source, it's unlikely it's actually stucked if data is coming in, so I suspect you're confused by the root cause of the issue. Let me know Guilhem ... View more

@chrisboy68  Ok. so let's be simple, an Elastic Source is a virtual entity which is the combination of your choice. If you carefully read the doc, you will see different examples to illustrate this, but let's say in your context, you could have: a. entity "one" type: tstats search constraint: index=* sourcetype=*aws* host=<my HF1> b. entity "one" type: tstats search constraint: index=* sourcetype=*aws* host=<my HF2> Entity a represents data as a whole, such as b, so as long as there is data in entity "a" and monitoring rules are respected. then the entity is green. And so forth. You are the master of your constraints and you can choose what to do. For example, it is likely as the HF is the collector, the "host" Metadata is not the best suitable for the job, because it might be overriden (because in the data the host is not the host that collects but the underneath technical host, etc) So often, a good approach is to make your HF creating an indexed field which represents the collection layer, the pipeline if you like, which is then what you would add. With this approach, you could have an elastic source that does index=* sourcetype=*aws* collector::<my first collector> and entity b would be: index=* sourcetype=*aws* collector::<my second collector> As explained here: https://trackme.readthedocs.io/en/latest/userguide.html#elastic-source-example-2-custom-indexed-fields The Cribl Logstream integration for example relies on the excellent schema Cribl has, when it creates automatically an indexed field (cribl_pipe) which trackMe then relies on, look at the following: https://trackme.readthedocs.io/en/latest/cribl_integration.html (to give you some more understanding) Does this helps? ... View more

Hi @chrisboy68 ! Sorry for late replying on this one, and thanks for the mention, I am not monitoring actively Splunk community, we used to receive automatic messages with Splunk Answer but it is not happening anymore which I find a bit missing with the new site. So, to answer to your question, there are multiple ways to tackle this, very easily actually and builtin within the UI. The first answer is using Elastic Sources: https://trackme.readthedocs.io/en/latest/userguide.html#elastic-sources You basically can create a virtual data source (standard data sources represent the index + sourcetype) which match your need, for instance mydata_source:context1 which is underneath a tstats against index + sourcetype + host. And repeat the process up to your needs. As long as you are dealing with tstats searches, you can easily add these into the common "bucket" as shared elastic sources (which means handled via a single scheduled generating the SPL dynamically) For very large data sources, you could create dedicated trackers via the same UI. The second answer can be as well in the data host monitoring, there are two modes available (see the config UI), in the standard mode we monitor all sourcetype on a per host basis, and start alerting when none of the meet the monitoring rules (meaning none of these still come into Splunk) In the second mode (data host global alerting policy), TrackMe monitors sourcetypes individually per host, which means to be simple that the host would turn red if any of the sourcetypes monitored for that host is not meeting the monitoring conditions and rules. So, you have at least two builtin ways to address your needs, Elastic Sources which can be whatever you need, and data host monitoring with the proper level of configuration. (including what you include / exclude) Let me know if my explanation isn't clear enough 😉 Guilhm ... View more

@Elsurion  Came to this thread randomly for the same needs (elasticsearch Python) I just got rid of the logging.conf and that fixes import issues in 8.2.x ... View more

@emkaxon  Stil an issue? ... View more

@splurl  Use this addon instead:  https://splunkbase.splunk.com/app/4958/ ... View more

@tcsalone  Is it still an issue? I recently verified issue creation inline from incident review as an AR and it was working fine ... View more

@alidrab  Review: https://ta-jira-service-desk-simple-addon.readthedocs.io/en/latest/troubleshoot.html Likely your connectivity to JIRA is wrong, wrong credentials, credentials won't let you in, network issue etc ... View more

@avitsupport  Use https://splunkbase.splunk.com/app/4958/ ... View more

Hi @SaraO  Thank you 😉 Glad you like the richness of TrackMe! Document reference: https://trackme.readthedocs.io/en/latest/userguide.html#outliers-detection-and-behaviour-analytic To answer: - The outliers eventcount is a per 4 hour count, so it will not exactly match what you would see in Splunk unless you reproduce the way it the outlier calculation works - Not very sure where the 22 came from based on your screenshots, because of the time rounding you should look a bit more than the last 24 hours to check - This data source is unlikely to be a great candidate for outliers detections, the features is very much designed for continous and real time data flow more than this very specific use case that is going to very sporidically generate a single event per server, not saying you cannot get value from the outliers this case, you can, but it's certainly not the most valuable case - Not that the outliers detection workflow in TrackMe does not alert for the upper outliers by default, only the lower bound threshold by default, upper threshold is something you enabled on a per entity basis if you wish to do so Let me know if anymore questions 😉 Guilhem ... View more

Hi @lmcgchr  See the following issue: https://github.com/guilhemmarchand/trackme/issues/281 In a nutshell you could easily create your own workflow, with a scheduled report handling this: Example: | inputlookup trackme_data_source_monitoring | eval keyid=_key | search data_name="firewall:pan:traffic" | eval tags_expanded=tags | makemv delim="," tags_expanded | eval priority=if(tags_expanded="CIM", "high", priority) | fields - tags_expanded | outputlookup append=t key_field=keyid trackme_data_source_monitoring --> Create a report using a similar logic --> schedule this report to run on a regular basis, daily for example What it does is loading the collection, creating an expanded version of the tags, defining the priority, and updating the values. Everything else will be preserved y the outputlookup. Guilhem ... View more