Hi, I had the same challenge a few weeks ago and was able to make it work with the latest Splunk Stream version 8.1. This version supports custom apps to use propietary netflow configurations. Link to Splunk Documentation  You can reuse the existing definitions in the stream app from default/streams & default/vocabularies and copy them into your custom app.  If you want to use all existing netflow fields you have to keep in mind netflow utilizes additional vocabularies like ip.xml or flow.xml. In the ipfixmap.conf you can add the NAT fields with the netflow id. I used this table to get the correct values. Fields you don't define in ipfixmap.conf will use their default field id from the splunk stream app. When configured correctly you can choose you new custom stream in the Splunk Stream WebGUI. The ipfixmap.conf i used to get the NAT fields:   netflowElement.0.id = 225 netflowElement.0.termid = netflow.NATSourceIPAddress netflowElement.1.id = 226 netflowElement.1.termid = netflow.NATDestinationIPAddress netflowElement.2.id = 227 netflowElement.2.termid = netflow.NAPTSourceTransportPort netflowElement.3.id = 228 netflowElement.3.termid = netflow.NAPTDestinationTransportPort Regards Thomas ... View more

Hi Jason, I made the changes you mentioned but still got these errors: Get error when collecting events. Traceback (most recent call last): File "/opt/splunk/etc/apps/TA-Azure-billing/bin/ta_azure_billing/modinput_wrapper/base_modinput.py", line 127, in stream_events self.collect_events(ew) File "/opt/splunk/etc/apps/TA-Azure-billing/bin/azure_billing.py", line 80, in collect_events input_module.collect_events(self, ew) File "/opt/splunk/etc/apps/TA-Azure-billing/bin/input_module_azure_billing.py", line 133, in collect_events access_token = get_access_token(global_client_id, global_client_secret, tenant_id) File "/opt/splunk/etc/apps/TA-Azure-billing/bin/input_module_azure_billing.py", line 32, in get_access_token raise e ProxyError: HTTPSConnectionPool(host='login.windows.net', port=443): Max retries exceeded with url: /*****************/oauth2/token (Caused by ProxyError('Cannot connect to proxy.', NewConnectionError(': Failed to establish a new connection: [Errno 111] Connection refused',))) So I also made the same changes you suggested in the get_access_token function: from: response = requests.post(endpoint,data=payload).json() to: proxies = {'http': 'http://host.com:3128','https': 'http://host.com:1080'} response = requests.post(endpoint, data=payload, proxies=proxies).json() After these changes the app is now able to use my proxy server and I am receiving data from Azure. Regards Thomas ... View more