Thank you all for your input on this issue.  We managed to get it working again after a great deal of trial and error.  We ended up creating a brand new service principal, and applying the same permissions again. We had to manually alter the manifest to be able to select "ReportingWebService.Read.All". Our working theory is that the service principal we have been using for years might be "outdated" in a way, as it started working instantly with a brand new service principal. We do not have any information from MS on this theory, as we were able to resolve the issue just before submitting a case to MS. Cheers, Rolf ... View more

According to the docs this option to `tstats` were introduced in 8.0.0.  I just recently discovered myself. 🙂 Cheers, Rolf ... View more

Could you try to do a | eval eventlenght = len(_raw) to see if Splunk truncates at the same position every time? ... View more

Hi there, how did you upgrade the UFs? If you remove the whole /opt/splunkforwarder and then installed 7.3.1.1, a new guid would have been generated. The GUID (since 5.x) gets stored in $SPLUNK_HOME/etc/instance.cfg , ref. https://docs.splunk.com/Documentation/Splunk/8.0.1/Admin/Instancecfgconf Cheers, Rolf ... View more

Thanks Jason, seems to work fine. We're running SSL-inspection on the proxies so I received the following, even tho the CA certificates are present in the OS cert store (RedHat 7.4): 2018-04-06 12:20:58,356 ERROR pid=8322 tid=MainThread file=base_modinput.py:log_error:307 | Get error when collecting events. Traceback (most recent call last): File "/opt/splunk/etc/apps/TA-MS-AAD/bin/ta_ms_aad/modinput_wrapper/base_modinput.py", line 127, in stream_events self.collect_events(ew) File "/opt/splunk/etc/apps/TA-MS-AAD/bin/MS_AAD_audit.py", line 68, in collect_events input_module.collect_events(self, ew) File "/opt/splunk/etc/apps/TA-MS-AAD/bin/input_module_MS_AAD_audit.py", line 75, in collect_events r = requests.get(url,proxies=proxies,headers=header) File "/opt/splunk/etc/apps/TA-MS-AAD/bin/ta_ms_aad/requests/api.py", line 70, in get return request('get', url, params=params, **kwargs) File "/opt/splunk/etc/apps/TA-MS-AAD/bin/ta_ms_aad/requests/api.py", line 56, in request return session.request(method=method, url=url, **kwargs) File "/opt/splunk/etc/apps/TA-MS-AAD/bin/ta_ms_aad/requests/sessions.py", line 488, in request resp = self.send(prep, **send_kwargs) File "/opt/splunk/etc/apps/TA-MS-AAD/bin/ta_ms_aad/requests/sessions.py", line 609, in send r = adapter.send(request, **kwargs) File "/opt/splunk/etc/apps/TA-MS-AAD/bin/ta_ms_aad/requests/adapters.py", line 497, in send raise SSLError(e, request=request) SSLError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:676) I did a bit of digging and changed the following in ta_ms_aad/modinput_wrapper/base_modinput.py to point to the correct CA store: return self.rest_helper.send_http_request(url=url, method=method, parameters=parameters, payload=payload, headers=headers, cookies=cookies, verify='/etc/pki/tls/certs/ca-bundle.crt', cert=cert, timeout=timeout, proxy_uri=self._get_proxy_uri() if use_proxy else None) ... View more