Can anyone tell me what the key difference(s) is between the Splunk Add-on for Microsoft Cloud Services vs the Microsoft Azure Add on for Splunk? Looking at the splunkbase descriptions they look almost identical in what data sources they can collect? Is the only difference that the Splunk Add-On can pull in blob storage logs? Or is there something else I am missing? Thanks, Andrew ... View more

I  just recently upgraded to 8.1.1 for our core Splunk infrastructure and our UF's. I noticed in the release notes for 8.1.1 it lists: Remove, suppress any field from Windows Eventlog via universal forwarder Reduce noisy and unnecessary data from Windows Logs by filtering on any fields available at the source.   Currently we are using the blacklist option and a few regex's to accomplish our goal of filtering certain windows events at the UF level.  Does anyone know where the documentation is that relates to the above new feature? Just trying to figure out the proper usage\syntax in the hopes we can eliminate our blacklist regex's. Thanks, Andrew ... View more

Hey All, I recently installed/configured the Microsoft Teams Add-on in an attempt to ingest call logs and meeting info from Microsoft Teams.   I have run into an issue I was hoping someone could help with or shed some light on. Add-On Version: 1.02 Splunk Version: 7.3.4 App is installed on a HF. I have followed the instructions on the setup and have the Subscription, User Reports, Call Reports and Webhook all setup in the inputs section of the app. It appears though the only thing working is the User Reports. I have granted all of the required permissions in Teams\Azure  per the documentation. The _internal logs don't give a whole lot of information indicating what the issue might be even with DEBUG logging enabled for the app. The only thing I am seeing in the logs indicating an issue was this: 127.0.0.1 - splunk-system-user [30/Jun/2020:09:05:36.213 -0500] "GET /servicesNS/nobody/TA_MS_Teams/properties/TA_MS_Teams HTTP/1.1" 404 144 - - - 0ms And this: 2020-06-30 09:25:43,189 ERROR pid=107176 tid=MainThread file=base_modinput.py:log_error:309 | Could not create subscription: 400 Client Error: Bad Request for url: https://graph.microsoft.com/beta/subscriptions The  documentation also mentions a webook which I am a little confused as to where that webhook resides. Is it in Teams itself or where the app is installed? It seems like the webook is in the app on the HF based on how the documentation reads? Any help would be greatly appreciated. Thanks, Andrew ... View more