We are working to integrate splunk with IDAM for SSO. WE have three splunk search head cluster for three set of users  groups. On checking the splunk metadata file, IDAM engineer is telling that all three environments has same entity ID and we need to change it to differentiate between the clusters. Please let me know how to do it. ... View more

Hi, We have configured syslog-ng to send data to indexers, Sometimes, the syslog file is getting updated but data is not getting into indexer. For the same index we are getting data from other files but only one file is not getting indexed. We have to restart syslog splunk process to get the indexing We have below setting configured already. [thruput] maxKBps = 0 [inputproc] max_fd = 1000 [tcpout:targetgrpmaster] autoLBFrequency = 30 indexerDiscovery = masterindexdiscovery forceTimebasedAutoLB = True maxQueueSize = 128MB [general] parallelIngestionPipelines = 6 [queue] maxSize = 256MB [queue=parsingQueue] maxSize = 128MB   ... View more

I am using version 1.1.0, the Log file doesnt show any error but I could it tries to get every 2 seconds, where the polling is 60 seconds. 2020-07-09 10:37:15,846 DEBUG pid=14036 tid=MainThread file=connectionpool.py:_new_conn:809 | Starting new HTTPS connection (1): reports.office365.com 2020-07-09 10:37:17,849 DEBUG pid=14036 tid=MainThread file=connectionpool.py:_make_request:400 | https://reports.office365.com:443 "GET /ecp/reportingwebservice/reporting.svc/MessageTrace?$filter=StartDate%20eq%20datetime'2020-07-09T07%3A22%3A05.982209Z'%20and%20EndDate%20eq%20datetime'2020-07-09T07%3A52%3A05.982209Z'&$skiptoken=3999 HTTP/1.1" 200 51899 2020-07-09 10:37:17,882 DEBUG pid=14036 tid=MainThread file=base_modinput.py:log_debug:286 | Next URL is https://reports.office365.com/ecp/reportingwebservice/reporting.svc/MessageTrace?$filter=StartDate%20eq%20datetime'2020-07-09T07%3A22%3A05.982209Z'%20and%20EndDate%20eq%20datetime'2020-07-09T07%3A52%3A05.982209Z'&$skiptoken=5999 2020-07-09 10:37:17,883 DEBUG pid=14036 tid=MainThread file=base_modinput.py:log_debug:286 | Endpoint URL: https://reports.office365.com/ecp/reportingwebservice/reporting.svc/MessageTrace?$filter=StartDate%20eq%20datetime'2020-07-09T07%3A22%3A05.982209Z'%20and%20EndDate%20eq%20datetime'2020-07-09T07%3A52%3A05.982209Z'&$skiptoken=5999 2020-07-09 10:37:17,883 INFO pid=14036 tid=MainThread file=setup_util.py:log_info:114 | Proxy is not enabled! 2020-07-09 10:37:17,884 DEBUG pid=14036 tid=MainThread file=connectionpool.py:_new_conn:809 | Starting new HTTPS connection (1): reports.office365.com 2020-07-09 10:37:19,820 DEBUG pid=14036 tid=MainThread file=connectionpool.py:_make_request:400 | https://reports.office365.com:443 "GET /ecp/reportingwebservice/reporting.svc/MessageTrace?$filter=StartDate%20eq%20datetime'2020-07-09T07%3A22%3A05.982209Z'%20and%20EndDate%20eq%20datetime'2020-07-09T07%3A52%3A05.982209Z'&$skiptoken=5999 HTTP/1.1" 200 50410 2020-07-09 10:37:19,852 DEBUG pid=14036 tid=MainThread file=base_modinput.py:log_debug:286 | Next URL is https://reports.office365.com/ecp/reportingwebservice/reporting.svc/MessageTrace?$filter=StartDate%20eq%20datetime'2020-07-09T07%3A22%3A05.982209Z'%20and%20EndDate%20eq%20datetime'2020-07-09T07%3A52%3A05.982209Z'&$skiptoken=7999 2020-07-09 10:37:19,853 DEBUG pid=14036 tid=MainThread file=base_modinput.py:log_debug:286 | Endpoint URL: https://reports.office365.com/ecp/reportingwebservice/reporting.svc/MessageTrace?$filter=StartDate%20eq%20datetime'2020-07-09T07%3A22%3A05.982209Z'%20and%20EndDate%20eq%20datetime'2020-07-09T07%3A52%3A05.982209Z'&$skiptoken=7999 ... View more

We ran kvstore clean command without a backup and looking for a way to restore it. We particularly want to recreate one lookup(minemeldfeeds_lookup) which comes with Palo Alto Networks, version -6.2.0. Please let us know if there is a way to do it Below is the lookup  error Error in 'lookup' command: Could not construct lookup 'minemeldfeeds_lookup, indicator, AS, client_ip, OUTPUT, value.autofocus_tags, AS, client_autofocus_tags'.  ... View more

Hi ,   We are trying to access SH through restapi but getting invalid certificate warning. How to get rid of this message and connect without any warning message. We are already using web and server certificate. ... View more

Hi Team, We are using splunk addon for service now to get cmdb table data from snow and We are seeing duplicate entries for the same sys_id seems whenever the CI record is updated it created new event for splunk. Please let me know how to correlate these events. we are trying to save the license and storage and don't like to update the same data again. ... View more

Hi, We are trying to integrate snow with Splunk using latest version of Splunk Add-on for ServiceNow . While configuring the snow url and credentials we are getting below error. We are using local snow username and it is SSO configured and version is "newyork". I am able to connect to the url from splunk server using /bin/splunk cmd openssl s_client -connect xxx.service-now.com:443. Unable to reach server at https://xxx.service-now.com. Check configurations and network settings ... View more