Looking to see if we can ingest data from O365 that would list a person's name and what they accessed within Sharepoint.  We were hoping that the new Graph API input from the O365 add-on would get us this information.  Our O365 admin states that he needs to setup an app registration for us to access O365 Graph. Different than the Tenant ID and Client ID we are using to connect to O365 from the SPlunk add-on He said - It would need to connect to Graph with the App ID and shared secret at a minimum What endpoint is Splunk trying to pull from when it is using the Graph API Inputs? O365 add-on documentation states:    O365:graph:api              All Audit events and reports visable through the Microsoft Graph API endpoints. This                                               includes all the logs events and reports visable thr the MS graphic API   Any help is appreciated.  ... View more

Azure add-on has been install on HF for months.  The certificate expired last week. appears to have caused an issue with the Azure add-on. no data ingesting since certificate expired.  * certificate was replaced.  * data started ingested again right after the new certificate was working.  * then after about 4 hrs no data was being ingested again on the HF for the azure add-on * from recommendations on answers, changed the "Max Batch Set Iterations" to 1000 -- didn't help * why would data be ingesting into SPlunk after the certificate was replaced but then stop being ingested into Splunkl   ... View more

Creating Inputs for "Tenable.sc vulnerability". what would the "Enter the query name for Tenable.sc vulnerability filter" be?  Is there an example of a "query name for Tenable.sc vulnerability filter" ?  ... View more

We have a deployment server in a separate domain. I wanted to know if the deployment server needs to be able to connect to the license server. Do i need to open port 8089 from the deployment to the license server or visa versa? ... View more

i have installed db connect on a SHC via the deployer. The jdk1.1.8.0_131 is installed on the deployer in the /opt/splunk/etc/shcluster/apps/splunk_app_db_connect/drivers/jdk1.8.0_131 It was pushed to the SHC captain - location of jdk1... /opt/splunk/etc/apps/splunk_app_db_connect/drivers/jdk1.8.0_131/ * changed the path on the dbconnect app via the splunk console/qui to /configuration/settings/ * in the JRE Installation Path(JAVA_HOME) i have the exact path that the jdk1... is located. But i receive a JAVA_HOME path not exist" when i try to save it. Any idea why it won't save one of the SHCs via the splunk console/gui? In what file does the confguration/settings reside. Maybe i need to change it there in the deployer and then push it to the SHC captain. ... View more