About arowsell_splunk

arowsell_splunk · ‎04-06-2022

This issue has been addressed in the below bug: ADDON-49247 - O365 CIM tagging not complete Behaviour is addressed as below: - Check if its Auth event or not - If its auth event then we will check for the LogonError event field - If we there is a Logon Error then action will be failure otherwise it will be Success This fix should be included in the Splunk Add-on for Microsoft Office 365, 3.1.0 release which is targeted for End of April, 2022.

manuelostertag · ‎04-07-2021

Hello @andrewtrobec , I've tested HEADER_FIELD_ACCEPTABLE_SPECIAL_CHARACTERS = . and it doesn't work (I think this has something to do with ACSI above 128). But if I use HEADER_FIELD_ACCEPTABLE_SPECIAL_CHARACTERS = ä,Ä,ü,Ü,ö,Ö,ß it worked 👍 @arowsell_splunkare there any disadvantage of using this? Regards Manuel

mitani · ‎04-18-2019

Here is how i managed to create glass tables via REST calls. Method: POST Endpoint: /servicesNS/nobody/SA-ITOA/itoa_interface/glass_table JSON: { "content": [ ], "acl": { "can_share_global": true, "sharing": "app", "perms": { "read": [ "*" ], "write": [ "*" ] }, "can_write": true, "owner": "xxx", "can_share_app": true, "modifiable": true, "can_change_perms": true, "can_share_user": true }, "identifying_name": "xxx", "title": "xxx", "_owner": "nobody", "_user": "nobody" } Make sure to fill in owner, title, identifying_name and modify any true/false based on your needs. Good luck! ,Here is how i managed to create glass tables via REST calls. Method: POST Endpoint: /servicesNS/nobody/SA-ITOA/itoa_interface/glass_table JSON: { "content": [ ], "acl": { "can_share_global": true, "sharing": "app", "perms": { "read": [ "*" ], "write": [ "*" ] }, "can_write": true, "owner": "xxx", "can_share_app": true, "modifiable": true, "can_change_perms": true, "can_share_user": true }, "identifying_name": "xxx", "title": "xxx", "_owner": "nobody", "_user": "nobody" } Make sure to fill in owner, title, identifying_name and modify any true/false based on your needs. Good luck! ,Here is how i managed to create glass tables via REST calls. Method: POST Endpoint: /servicesNS/nobody/SA-ITOA/itoa_interface/glass_table JSON: { "content": [ ], "acl": { "can_share_global": true, "sharing": "app", "perms": { "read": [ "*" ], "write": [ "*" ] }, "can_write": true, "owner": "xxx", "can_share_app": true, "modifiable": true, "can_change_perms": true, "can_share_user": true }, "identifying_name": "xxx", "title": "xxx", "_owner": "nobody", "_user": "nobody" } Make sure to fill in owner, title, identifying_name and modify any true/false based on your needs. Good luck!

runner724 · ‎06-26-2017

Our users on IE11 with the Compatibility Mode enforced were able to view Splunk prior to the 6.6 update. I conclude the issue is on the Splunk side. In our large enterprise environment the compatibility mode is set via GPO so I can't tell my users to change it as a workaround. Scripting before the <meta http-equiv="X-UA-Compatible" content="IE=edge" /> directive causes it to be ignored. Per Microsoft documentation, The X-UA-Compatible header isn't case sensitive; however, it must appear in the header of the webpage (the HEAD section) before all other elements except for the title element and other meta elements. https://msdn.microsoft.com/en-us/library/jj676915(v=vs.85).aspx Here is the top of the HTML generated when I visit a Splunk dashboard in IE11, demonstrating <meta http-equiv="X-UA-Compatible" content="IE=edge" /> being placed after scripting: <!doctype html>      <html lang="en" class="no-js">  <head> <meta name="referrer" content="never" /> <meta name="referrer" content="no-referrer" /> <script> window._splunk_metrics_events = { push : function() {}, active: false, } </script> <meta http-equiv="X-UA-Compatible" content="IE=edge" /> <meta charset="utf-8" /> <title>Loading...</title> (rest of the source omitted) Here are some simpler examples that demonstrate this issue. If I visit this webpage in IE11 with the compatibility mode on, it renders in 'edge' (latest) document mode: <!doctype html> <html> <head> <meta name="referrer" content="never" /> <meta name="referrer" content="no-referrer" /> <meta charset="utf-8" /> <meta http-equiv="X-UA-Compatible" content="IE=edge" /> <title>Test - meta tags are proper</title> <script> console.log("logging something to the console"); </script> </head> <body> Test - meta tags are proper </body> </html> If I visit this webpage in IE11 with the compatibility mode on, it renders in IE7 document mode: <!doctype html> <html> <head> <meta name="referrer" content="never" /> <meta name="referrer" content="no-referrer" /> <script> console.log("logging something to the console"); </script> <meta charset="utf-8" /> <meta http-equiv="X-UA-Compatible" content="IE=edge" /> <title>Test - meta tags are after some scripting</title> </head> <body> Test - meta tags are after some scripting </body> </html> The only difference is the position of the script block.

arowsell_splunk · ‎11-29-2016

The following bug was raised for this matter: SPL-131827 : Error when anonymizing diag "string index out of range" The error can be resolved by making the following changes Open the file $SPLUNK_HOME/bin/scrubber.py Look for MAX_SEGMENT = 1024 - change it to MAX_SEGMENT = 4096 Then re-run the anonymizing command

arowsell_splunk · ‎02-22-2017

Hi, There is a bug introduced in 6.5: SPL-133720 - splunkd instrument-resource-usage process uses one full CPU core after upgrade to 6.5.1 on Centos 5 To workaround the issue is 6.5.0, 6.5.1 and 6.5.2 you can disable introspection as per the following: https://docs.splunk.com/Documentation/Splunk/6.5.2/Troubleshooting/ConfigurePIF To disable: in $SPLUNK_HOME/etc/apps/introspection_generator_addon/local/app.conf, set: [install] state = disabled This should be fixed in 6.5.3.

cmerriman · ‎11-03-2016

http://docs.splunk.com/Documentation/SplunkCloud/6.5.0/User/Admintasks Editing and .conf directly in Splunk Cloud requires a Support Ticket with Splunk Support. http://docs.splunk.com/Documentation/SplunkCloud/6.5.0/User/Useraccounts You can change user account settings, such as the password as @arowsell has mentioned, and remove the searches. After doing that you can delete the user account.

sloshburch · ‎07-31-2017

To clarify, you see those are "INFO" events, right? Not "ERROR" or "WARN". Just want to make sure you don't go after a red herring.

corey_reynders · ‎10-15-2018

I think my appsCA.pem got messed up. I copied it from another instance and was able to get this to function without any weird config or root/intermediate changes.

niketn · ‎08-15-2018

Refer to answer Why is the embedded report not working after the upgrade to 7.0.3+ by @mchang

pkarpushin · ‎10-09-2018

Didn't work with 7.0.1 at first. After upgrading SH to 7.1.3 worked as a charm. Thanks @arowsell

Posts	22
Solutions	3
Karma Given	11
Karma Received	35
Member Since	‎06-16-2016

Online Status	Offline
Date Last Visited	‎04-06-2022 11:22 AM

How to resolve error "string index out of range" w...

Accessing apps in 6.4.x results in "Error connecti...

Re: O365 TA reports incorrectly action

Re: How can i get Splunk 8.0.5 to accept accented ...

Re: Create new ITSI Glass Table through - Rest API...

Re: Splunk 6.6.0 not working with IE11 and DNS Nam...

Re: How to resolve error "string index out of rang...

Re: What is the process "splunkd instrument-resour...

Re: Cannot delete saved searches of a user that no...

Re: After upgrading to 6.5.0, why are there so man...

Re: Accessing apps in 6.4.x results in "Error conn...

Re: Why is an embedded report on a webpage not get...

Re: indexes from peer nodes not visible in role cr...