Hi. Thank you for the bugfix. For now I will update the app description to include the fix. For future release I can correct this. Do you happen to have any sample logs you could share with me? I developed the app with very minimal samples and would like to expand the addon if possible. But i don't have access to a Trend CM server. ... View more

the file doesn't exist. do this to create it touch /etc/rc.conf then run then enable boot-start command this will actually create the startup script in /etc/rc.d/splunk and in /etc/rc.conf you will now see, splunk_enable="YES" If it doesn't auto start, copy the splunk_enable line from /etc/rc.conf into /etc/rc.conf.d/splunk ... View more

duckduckgo.com/?q=change+splunk+management+port https://answers.splunk.com/answers/44270/change-splunk-web-server-from-the-default-setting-of-port-8000-to-port-8081.html http://docs.splunk.com/Documentation/Splunk/latest/Admin/Changedefaultvalues#Change_network_ports ... View more

copy \default\eventtypes.conf to \local\eventtypes.conf within the TA-Tomato directory, then update the searches with the correct index name where your open router data is ... View more

hi. I might be way too late for this, maybe you've already gotten it working or have moved on to other things. but what sourcetype does your router data show as after onboarding it as syslog1? does anything get re sourcetyped? It's possible some of the initial regexes need to be written a bit more general. I've since tested this app on Advanced Tomato, and DD-wrt and most of it works well out of the box, but that may be based on the way I syslog the events first, which could write files differently than yours. I know many dd-wrt builds have varying capacities to syslog, some require odd setting changes like filter ident before they actually syslog all data. Some only do firewall or only system and not both at the same time. Newer bigger routers with more memory seem to be more capable than older ones, especially when doing full packet monitoring. I am slowly working on rewriting this TA based on what i've learned since first releasing the initial builds ... View more

I copied it in as db_inputs.conf and saw most of it worked. So I used the gui to find where it thought it was broke. I then used the settings from the TA MS SQL to create a new input via the gui of DB Connect3. Below is a comparison if it helps people modify their existing configurations from Splunk_TA_microsoft-sqlserver\default\sqlserver_dbx2.conf ## mssql:alwayson [mi_input://:alwayson:dm_hadr_auto_page_repair] connection = SQLServer index = main interval = 300 max_rows = 10000 mode = batch output_timestamp_format = YYYY-MM-dd HH:mm:ss query = SELECT *,CONVERT(varchar(128),SERVERPROPERTY('ServerName')) AS ServerName, db_name() AS DatabaseName FROM sys.dm_hadr_auto_page_repair source = dbx2 sourcetype = mssql:alwayson:dm_hadr_auto_page_repair ui_query_mode = advanced disabled = 0 And as saved in splunk_app_db_connect/local/db_inputs.conf [alwayson:dm_hadr_auto_page_repair] connection = SQLSERVER host = hostname/IP index = main interval = 300 max_rows = 10000 mode = batch query = SELECT *,CONVERT(varchar(128),SERVERPROPERTY('ServerName')) AS ServerName, db_name() AS DatabaseName FROM sys.dm_hadr_auto_page_repair source = DBX sourcetype = mssql:alwayson:dm_hadr_auto_page_repair ui_query_mode = advanced And finally, in splunk_app_db_connect/local/inputs.conf ## mssql:alwayson [mssql:alwayson:dm_hadr_auto_page_repair] mode = batch output_timestamp_format = YYYY-MM-dd HH:mm:ss ui_query_mode = advanced ... View more

So it seems the app calls itself on the redirect URL, which then communicates with o365/azure. Azure would see the incoming URL as your Redirect URL. So, internal address works for the application so long as the URL loads for you locally. (accessible internal) ... View more