About adalbor

PickleRick · ‎06-28-2024

1. This is a 5-year-old thread. Post your question as a new thread to give it visibility. 2. Be a bit more descriptive. I suspect I know what you mean but it's nice to be sure that all parties are on the same page.

Joelthemole · ‎04-11-2023

I have managed to resolve this on my OAUTH setup. Error 401 is permissions error, this is from the official add on trouble shooting: The Splunk Add-on for Microsoft Office 365 requires ReportingWebService.Read.All. Verify this permission is selected, saved, and then granted within the Office 365 Management Activity API configuration on Azure Active Directory. So in order to fix: In the Azure Portal, go to App registrations > All applications Select your application Select API Permissions Click Add a permission to display the Request API permission flyout page On the APIs my organization uses tab, select Office 365 Exchange Online On the flyout page, select Application permissions, and then click Add permissions The Reporting Web Service should now appear in the list of applications that your app requires permissions for Select Grant admin consent for "YourTenant" to consent to the permissions given to your app

jconger · ‎08-29-2022

The originally required permissions were either Global Administrator or Exchange Administrator. However, Microsoft has changed that to now allow the Global Reader role.

StuartMacL · ‎10-01-2021

I realise this is an old thread, but apparently still relevant! I have the same issue, (and have done in the past). Previously I asked Splunk support to fix it, and they did.... After about 2 weeks. When I go to Indexes in the IDM, I can see all the indexes (60 of them) so the index.conf file must have been copied over to the IDM from our Search Head. However, the Office 365 app can only see the default 3, plus the one I previously asked support to make visible. When I run your query, I only see a few - what does this mean? I have admin rights already, so that cant be the issue. I even tried adding my user to every role available!

adalbor · ‎06-15-2021

Hey All, Hoping someone can help with an issue with the Rapid 7 Insight VM TA. We recently upgraded the app from 1.0.5 to 1.1.0. After upgrading the app stopped working and started throwing an error. The GUI for the app would no longer completely load after the upgrade, config\inputs page would halfway load and just spin. I removed the new version and re-installed the older version 1.0.5 but still the same issues. Is anyone else having issue with it that might be able to assist? Splunk Version: 8.1.1 App is installed on a HF We get the attached error in the newer version and the older version now. Seeing alot of these python related errors also: 06-15-2021 10:04:01.511 -0500 ERROR ScriptRunner - stderr from '/opt/splunk/bin/python3.7 /opt/splunk/bin/runScript.py setup': ImportError: cannot import name 'validator' from 'splunktaucclib.rest_handler.endpoint' (/opt/splunk/etc/apps/TA-rapid7-insightvm/bin/ta_rapid7_insightvm/aob_py3/splunktaucclib/rest_handler/endpoint/__init__.py)

grobendg · ‎06-12-2021

One key difference is Eventhub ingestion. Microsoft Azure Add on for Splunk (now deprecated) -> ingests Eventhubs through old ClientSecret String Splunk Add-on for Microsoft Cloud Services -> ingests Eventhubs through modern Azure-AD app with Reader rights into eventhub

SinghK · ‎06-07-2021

you need to clean the kv store with this command below: splunk clean kvstore -app TA_MS_Teams -collection TA_MS_Teams_checkpointer and restart splunk . that should fix the issue.

adalbor · ‎05-19-2021

Are you trying to export the logs? Or use blob storage for index storage?

adalbor · ‎04-29-2021

I should of looked a little harder. Seems it was in the inputs.conf documentation https://docs.splunk.com/Documentation/Splunk/8.1.1/Admin/Inputsconf#Windows_Event_Log_Monitor

DavidHourani · ‎03-16-2021

Hi @port7, SmartStore (S2) Is currently not supported on Azure, you can still technically build it if needed by leveraging solutions such as MinIO. Whitepaper here: https://min.io/resources/docs/Leveraging-MinIO-for-Splunk-SmartStore-S3-storage.pdf Hope this helps! Cheers, David

mhotsi · ‎03-01-2021

Hello Marc, I would like to know more about the powerscript solution.

adalbor · ‎12-15-2020

Hey All, Was just curious if there is a way to calculate how long it should take to thaw\rebuild frozen buckets for searching? We recently started a thaw of a month's worth of data of Windows events that is taking a considerable amount of time. Going on 5 hours now across 3 clustered IDX's. We have 6 total IDX's clustered and we perform the thaw\rebuild on 3 at a time to ensure we can balance data ingestion and the thaw process. I would love to be able to set expectations when other business units ask for historical data to be loaded, on how long it will take to be ready. I'm sure it depends on CPU\HDD speed\bucket size but was curious if anyone has a way to determine some rough calculations. Thanks! Andrew

dmacintosh_splu · ‎10-07-2020

That is great to hear and apologize for misunderstanding the question you were asking. I have personally not heard of much pain from v7.3.x to v8.x, mostly from v7.2.x and prior to anything beyond v7.3.x. I look forward to seeing some other responses, have a great day!

isoutamo · ‎09-04-2020

Hi Easiest way is to automate the build of your test environment (e.g. with ansible) and then use locally trial licenses. Those allows also clustering, but not LM usage. Personally I avoid to use production data (even masked/anonymized). I prefer to take some (system/integration) test environment data for that purpose. Also you could use any test data generation systems if you have those in use. r. Ismo

adalbor · ‎07-02-2020

Hey All, Finishing the configuration and tuning of the Microsoft 365 App for Splunk and on the overview dashboard under M365 a single panel is having an issue with a macro. Error message: Error in 'SearchParser': The search specifies a macro 'o365_service_status' that cannot be found. Reasons include: the macro name is misspelled, you do not have "read" permission for the macro, or the macro has not been shared with this application. Click Settings, Advanced search, Search Macros to view macro information. I checked the app's default and local folders and in the GUI and don't even see this macro anywhere. Anyone have any clue what this macro holds so that I can create it to get this dashboard panel working? Thanks, Andrew

adalbor · ‎07-01-2020

Thanks was looking for this solution too!

richgalloway · ‎05-20-2020

This search can get you most of what you seek, except for number of events. index=_internal source="*license_usage.log" sourcetype=splunkd | stats sum(b) as Bytes by h,s,st,idx | eval MB=round(Bytes/1024/1024,3) | rename h as Host, s as Source, st as Sourcetype, idx as Index, MB as "License Used in MB" | table Host, Source, Sourcetype, Index, "License Used in MB"

adalbor · ‎05-19-2020

Ok, thanks for the info Giuseppe. Was just gauging the community to see what my options were and to do due diligence.

to4kawa · ‎05-14-2020

Do you use SHOULD_LINEMERGE = true ?

adalbor · ‎05-05-2020

This was working with one entry in the lookup file but not that I have multiple entries my search returns no results. Why is it so difficult in splunk to have one field searched against with the contents of a lookup file? It almost seems easier just to make a massive search string at some point.

adalbor · ‎03-24-2020

I ended up resolving the issue I had. The UF in question that wasn't working was going through a HF rather than straight to my IDX's Applied the following to the HF's and IDX's and it started dropping the matching events. Support also recommended I use source rather than sourcetype as it was more reliable. Props.conf [source::c:\DNSLOGS\dns.log] TRANSFORMS-dropdns=dropdns1,dropdns2 Transforms.conf [dropdns1] REGEX = .1.1.1.1. DEST_KEY = queue FORMAT = nullQueue [dropdns2] REGEX = .2.2.2.2. DEST_KEY = queue FORMAT = nullQueue

adalbor · ‎02-17-2020

Thanks for the info!

adalbor · ‎02-21-2020

Support states that this is not possible without a convoluted solution.

adalbor · ‎02-12-2020

Hey All, We finally found a solution to this but it didn't exist within the output search command. We ended up modifying a couple of the python scripts within the ServiceNow Security Operations app to extract the _time based on a special character placed before the string then convert to ISO format then pass back to the function that sent it to the API. We were also able to insert line breaks into the data once it was placed in the Description field of ServiceNow using a similar method.

RK_sp1unk · ‎02-10-2020

we did test the DB connection is fine , also most of the queries are giving results but older results like of nov 2019 not of feb 2020 check point value is blank also |tstats count where index=mcafee by sourcetype when i search this using normal search no results also using the DB connect app no results what needs to be checked else to resolve this issue how can i check if there is a table permission issue , user says queries used to run and fetch the data automatically connection is mcafee_epo_5_db table name is "eP04_VAVSRV01"

Posts	172
Solutions	14
Karma Given	74
Karma Received	17
Member Since	‎01-29-2019

Online Status	Offline
Date Last Visited	‎02-25-2022 07:48 AM

Errors with Rapid7 InsightVM TA

Splunk Add-on for Microsoft Cloud Services vs Micr...

Windows Eventlog field suppression in 8.1.1

Calculate Bucket Thaw Time

Upgrade from 7.3.7 to 8.0.6

Build out of Test Environment Recommendations\Best...

Microsoft 365 App for Splunk: macro error on overv...

Ingesting logs from Microsoft Teams

Clone Splunk Indexer?

o365:management:activity field extractions

Re: CIM, Data Model, and Tagging Help

Re: Receiving 401 error when attempting to connect...

Re: Microsoft Office 365 Reporting Add-on for Splu...

Re: Not listing any custom indexes

Errors with Rapid7 InsightVM TA

Re: Splunk Add-on for Microsoft Cloud Services vs ...

Re: Ingesting logs from Microsoft Teams

Re: Splunk Logs to Azure Blob Storage

Re: Windows Eventlog field suppression in 8.1.1

Re: SmartStore on Azure?

Re: O365 message tracking logs

Calculate Bucket Thaw Time

Re: Upgrade from 7.3.7 to 8.0.6

Re: Build out of Test Environment Recommendations\...

Microsoft 365 App for Splunk: macro error on overv...

Re: Map on "Microsoft 365: Usage & Adoption" dashb...

Re: How to create search for daily license usage r...

Re: Clone Splunk Indexer?

Re: o365:management:activity field extractions

Re: Filter Events based on lookup file contents

Re: Best way to nullQueue DNS logs by source

Re: Universal Fowarder: Upgrade and switch to low ...

Re: Tag Event after using workflow action

Re: _time passed to Workflow Search string not for...

Re: Splunk DB connect not loading data using Splun...

Join the Conversation