This issue has been addressed in the below bug: ADDON-49247 - O365 CIM tagging not complete Behaviour is addressed as below:   - Check if its Auth event or not - If its auth event then we will check for the LogonError event field - If we there is a Logon Error then action will be failure otherwise it will be Success   This fix should be included in the Splunk Add-on for Microsoft Office 365, 3.1.0 release which is targeted for End of April, 2022. ... View more

Not sure the exact curl command being used but was able to create an empty Glass Table using the following on ITSI v4: curl -k -u admin https://localhost:8089/servicesNS/nobody/SA-ITOA/itoa_interface/glass_table -H "Content-Type:application/json" -X POST -d '{"_owner": "admin","title": "test_API_glass_table","description": "test_glass_table","object_type": "glass_table","latest": "now","latest_label": "now","svg_coordinates": {"viewdy": 0, "viewdx": 0}, "is_epoch": "false", "templateSwappableServiceIds":[]}' Don't know if this helps. ... View more

Hi, 7.1.2 has an ETA around the 9th July but there is always the possibility this may be pushed back if there are any last minute issues with its QA but I would expect it to be out around that date. ... View more

Hi, yes there appears to be a regression of this issue in 7.1.0 and 7.1.1. It has been fixed in Splunk version 7.1.2. ... View more

Hi, I have just checked and there appears to be a regression of this issue in 7.1.0 which has been addressed in Splunk 7.1.2. ... View more

Please note, the issue has reoccurred in Splunk 7.0 and the following bug has been raised for this matter: SPL-145546 - in 7.x in Roles admin Indexes are for local search head only Workaround: Step 1) Create a local directory in the search app on the SH with the correct permissions for splunkd to access i.e. $SPLUNK_HOME/etc/apps/search/local/data/ui/manager Step 2) Copy an old "authentication_roles.xml" file from "$SPLUNK_HOME/etc/apps/search/default/data/ui/manager" in any 6.x version or simply download a new 6.x version of Splunk and extract the file there, then place it into the folder created in step 1. Step 3) Refresh the SH configuration with debug refresh via the web browser: http://:8000/en-US/debug/refresh Step 4) Create a new role on the SH and you should see all your indexes configured on the index cluster. Note: In the workaround provided above, there is a known issue (SPL-146171) where only 1000 indexes is displayed in the UI. If you have more than 1000 indexes, you should modify authorize.conf to add the index(es) to role(s) instead ... View more

This matter I believe is caused by the IE Compatibility mode. To reproduce: On IE 11 Login to Splunk 6.6. In IE go to: Settings --> Compatibility View Settings Add the Splunk instance to the "Websites you've added to Compatibility View", do this by selecting "Add this website:" Now in Splunk navigate to: Settings --> Indexes The page will not load. Other pages are also effected. If you go to the IE debugger you will see that the page is being rendered in IE 7 instead of IE 11. The same does not occur on Splunk 6.5.x, the pages always default to IE 11 in Compatibility mode. The following bug is open for this matter: SPL-141947 - Splunk 6.6.0 and IE 11 compatibility mode The current workaround is to disabled compatibility mode. ... View more

Hi, There is a bug introduced in 6.5: SPL-133720 - splunkd instrument-resource-usage process uses one full CPU core after upgrade to 6.5.1 on Centos 5 To workaround the issue is 6.5.0, 6.5.1 and 6.5.2 you can disable introspection as per the following: https://docs.splunk.com/Documentation/Splunk/6.5.2/Troubleshooting/ConfigurePIF To disable: in $SPLUNK_HOME/etc/apps/introspection_generator_addon/local/app.conf, set: [install] state = disabled This should be fixed in 6.5.3. ... View more

Hi, Sorry my response is a little late but I have just recently come across the same issue. As I understand if remote_timeline is enabled (default option) in limits.conf then timeline will be built remotely. This is not a new behavior with 6.5.0. I have seen that increasing "max_chunk_queue_size" in the limits.conf file can improve search improvement. It has by default increased from 1MB to 10MB between versions 6.3.x and 6.5.x. You may like to increase this further. Also, the following parameters can also effect this behavior: fetch_remote_search_log = disabledSavedSearches remote_timeline = true remote_timeline_fetchall = 1 Setting them as follows has been seen to have a positive impact on the search speed: fetch_remote_search_log = false remote_timeline = true remote_timeline_fetchall = false However, there may be other reasons for the searches not finalizing but without reviewing the full log files it is difficult to say. I was also wondering if you manage to resolve the issue and what steps you took? ... View more

Hi, the easiest way as a Splunk Admin would be to re-created the user account of the ex-colleague with a different password. When you login as this user you should be able to see all their saved searches etc and have the ability to delete them. You could also probably delete them through the CLI. ... View more

Please note that the following bug has been raised for this matter: SPL-129870 - PDF and CSV attachments don't show up when viewing email on iPhone's default mail application Both PDF and CSV files are effected. It has been determine for HTML emails in 6.5, the _subtype of MIMEMultipart was changed from "mixed" to "related" which is not working for iPhone's default mail application. The bug is planned to be fixed in Splunk version 6.5.1. ... View more

Hi Corey, It is difficult to say without looking at a Splunk diag, your certs and a network trace. I would recommend that you run a network trace (e.g. wireshark) and see where in the SSL handshake it is failing. ... View more

Hi Corey, The solution is really dependent on your network architecture. You may also have a Root and/or an Intermediate CA. So you may also have to add these as well, for example: -----BEGIN CERTIFICATE----- SERVER CERT HERE -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- INTERMEDIATE CA IF REQUIRED -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- ROOT CA -----END CERTIFICATE----- If this does not help, you may like to raise a case with Splunk support. ... View more

The following bug: SPL-122982 - Embedded report uses oldest search artifact from the history endpoint Is now reported fixed in Splunk version 6.4.3. ... View more

Certainly, I can update this post when the bug is updated. I'm glad the information helped : ) ... View more

The following bug has been opened: SPL-122982 - Embedded reports use oldest search artifact In Splunk 6.4 embedded report is looking at the oldest copy of the related search artifact, rather than the latest. In 6.3 the embedded report looks at the newest artifact. ... View more

I suspect the issue is caused because the embedded report is looking at the oldest copy of the related search artifact, rather than the latest. For example, if I have an embedded report named "embedtest", which is scheduled to run every 1 minute. Every minute a new search artifact is created in the $SPLUNK_HOME//var/run/splunk/dispatch directory. These may look at follows: 16 Jun 11:00 scheduler__admin__search__embedtest_at_1466071200_12 16 Jun 11:01 scheduler__admin__search__embedtest_at_1466071260_14 Now the embedded report should look at the latest search artifact "1466071260_14" but instead it is looking at the oldest artifact "1466071200_12". As per the documentation these search artifact should exist for the time period specific in the dispatch.ttl option in the savesearches.conf file: http://docs.splunk.com/Documentation/Splunk/6.2.9/Admin/Savedsearchesconf However, sometimes these search artifacts are not cleared up and old ones can remain. This may explain why some of your reports are showing very old data. In 6.3.3 it appears the embedded report looks at the newest artifact, not the oldest. Does this explain your behavior? ... View more