Hello, Do you have experience with Splunk - Rocky Linux since that? We should migrate our Centos7 soon and one of the candidates is Rocky 9. But the system requirements page https://docs.splunk.com/Documentation/Splunk/9.2.0/Installation/Systemrequirements does not list its kernel version (5.14) anymore.  (same for RHEL)  I believe it will work, but since I need to migrate a physical production server, I want to reduce the risk as much as I can... ... View more

That is a portability bug in the Python code of the add-on. The right way to proceed is to seek updates for this add-on, and if you are already at the latest version, file a Splunk support ticket with the below information, since the add-on is Splunk Supported. Details of the problem: The format codes you can pass to a Python datetime object's strftime method (that "work on all platforms with a standard C implementation") are documented at https://docs.python.org/3/library/datetime.html?highlight=strftime#strftime-strptime-behavior. %s is not one of them. It's a GNU extension to the C89 standard (compare the Python docs with strftime(3) from Debian 8.1.0). This means %s can be used where Python is built on top of the GNU C library (e.g. Red Hat Enterprise Linux), but cannot be used elsewhere (e.g., Windows). That's why the exception "Invalid format string" was raised. %s is supposed to produce the number of seconds since 1970-01-01 00:00:00 +0000 (UTC). Python datetime objects can do this using their timestamp method, which appears to be equally available on all platforms. So, line 125 of splunk_ta_o365/bin/splunk_ta_o365/modinputs/graph_api.py should perhaps say: expiration = int(message.update_time.timestamp()) Some additional code may be necessary to treat timezones properly. ... View more

sorry for late answer, but i found the problem. One of the splunk instances i was testing on was configured as a search head on the other splunk instance. This worked. [estreamRouting1] SOURCE_KEY = _raw REGEX = .1. DEST_KEY = _TCP_ROUTING FORMAT = Splunk_Old [estreamRouting2] SOURCE_KEY = _raw REGEX = .2. DEST_KEY = _TCP_ROUTING FORMAT = Splunk_Test ... View more