Hi,    Trying to configure authentication connection between Splunk and Service Now using service now add on. I can confirm the connection the service now server is open and operational but I am still seeing "Unable to reach server at https://dev.connectedservices.homeaffairs.gov.au. Check configurations and network settings" Looking into the splunkd logs and the splunk_ta_snow_main.log I am seeing the following error: Stack trace from python handler:\nTraceback (most recent call last):\n File "C:\Program Files\Splunk\Python-2.7\Lib\site-packages\splunk\admin.py", line 94, in init_persistent\n hand.execute(info)\n File "C:\Program Files\Splunk\Python-2.7\Lib\site-packages\splunk\admin.py", line 594, in execute\n if self.requestedAction == ACTION_CREATE: self.handleCreate(confInfo)\n File "C:\Program Files\Splunk\etc\apps\Splunk_TA_snow\lib\splunktaucclib\rest_handler\admin_external.py", line 51, in wrapper\n for entity in result:\n File "C:\Program Files\Splunk\etc\apps\Splunk_TA_snow\lib\splunktaucclib\rest_handler\handler.py", line 116, in wrapper\n for name, data, acl in meth(self, *args, **kwargs):\n File "C:\Program Files\Splunk\etc\apps\Splunk_TA_snow\lib\splunktaucclib\rest_handler\handler.py", line 85, in wrapper\n check_existing(self, name),\n File "C:\Program Files\Splunk\etc\apps\Splunk_TA_snow\lib\splunktaucclib\rest_handler\endpoint\__init__.py", line 79, in validate\n self._loop_fields('validate', name, data, existing=existing)\n File "C:\Program Files\Splunk\etc\apps\Splunk_TA_snow\lib\splunktaucclib\rest_handler\endpoint\__init__.py", line 76, in _loop_fields\n return [getattr(f, meth)(data, *args, **kwargs) for f in model.fields]\n File "C:\Program Files\Splunk\etc\apps\Splunk_TA_snow\lib\splunktaucclib\rest_handler\endpoint\field.py", line 52, in validate\n raise RestdError(400, self.validator.msg)\nRestError: REST Error [400]: Bad Request -- Unable to reach server at https://d. Check configurations and network settings.\n 08-28-2020 14:55:41.197 +1000 ERROR AdminManagerExternal - Unexpected error "<class 'splunktaucclib.rest_handler.error.RestError'>" from python handler: "REST Error [400]: Bad Request -- Unable to reach server at https://. Check configurations and network settings.". I am hoping someone maybe able to provide some assistance with this issue? ... View more

Hi, I have just begun ingesting F5 logs, I am not using the modular inputs component at present and am only seeing ASM logs via syslog. Logs are being sent to a syslog server and file monitoring is set to pull into splunk indexer. But when searching logs the logs dont seem to be separating expected "during index time, the add-on separates the data into more specific source types." I have an inputs.conf file on the rsyslog server distributed by a universal forwarder. [monitor:..........] disabled = 0 host_segment = 5 index=f5 sourcetype= f5:bigip:syslog I have removed the inputs from the indexer and have added the add-on to the search head as well. Confused as to why the logs are separating. Hoping someone can help Cheers ... View more

Hi, I have built out an AD inputlookup that includes lastlogon dates. When I attempt to find only those users with last logon older then 90 days I am unable to return any results. | inputlookup AD.csv | search lastLogon=* accountStatus!="ACCOUNTDISABLE" | where lastLogon>=relative_time(now(),"-90d@d") | table employee lastLogon I have parsed the dates with strftime and strptime within the lookup itself and can see the dates are being displayed correctly but no luck on refining the results to just those of interest. I have tried to define the relative time, reparsing the dates within the search itself. I have tried rearrange the date format and made sure to include the four year digits and still no luck. Not sure what I am missing. Any help would be appreciated ... View more

Hi, Im seeking clarification around configuration of the clearswift source type. I have followed the instructions however, still having issues getting the logs to identify as clearswift. The logs are coming through as syslogs from the clearswift server but is simply being identified as a syslog along with all others on the same line. What is the best way of ensuring I am getting the logs identified as clearswift? Regards ... View more