I am using the "Microsoft Office 365 Reporting Add-on for Splunk" (https://splunkbase.splunk.com/app/3720/#/details): We recently had an issue where, for some reason them timestamp recognition from 1.0 broke and all events were just getting the time of the pull as the time. This was down to the time configuration being applied to a sourcetype that our data was not being ingested against, and the sourcetype it was ingested against didn't define any specific time config. I can see that has now changed and it's all been placed into a single sourcetype with the time formatting. However, when reviewing the new 1.0.1 props.conf vs the 1.0 props.conf I can see the time format is different: v1.0 = TIME_FORMAT = %Y-%m-%dT%H:%M:%S v1.0.1 = TIME_FORMAT = %Y-%m-%dT%H:%M:%SZ I can't see anything on http://docs.splunk.com/Documentation/Splunk/7.0.2/SearchReference/Commontimeformatvariables that would show me what the addition of the Z will do. There is a %Z for time zone recognition but our data does not contain this so is still not likely to work. I do have a change window tonight and have removed the Z from the configuration, I just wanted to see if there was a valid use of the Z when none of the data I am seeing has this at the end of the timestamp after "DateReceived: " TIA ... View more

I can't see any configuration options which would allow me to see attachment data for my O365 message tracking logs. Any idea if there is something that can be done on the O365 side? Or will this add-on not provide that ability? ... View more

I have this add-on installed on a HFW, just installed the 0Gb ingestion license (to allow KVStore to run) but I am now getting SSL errors?!? I can't see any SSL configuration element in the app/docs so am not sure where to start. Full Error Message: 2017-10-16 09:36:03,597 ERROR pid=869 tid=MainThread file=base_modinput.py:log_error:307 | Get error when collecting events. Traceback (most recent call last): File "/opt/splunk/etc/apps/TA-MS_O365_Reporting/bin/ta_ms_o365_reporting/modinput_wrapper/base_modinput.py", line 127, in stream_events self.collect_events(ew) File "/opt/splunk/etc/apps/TA-MS_O365_Reporting/bin/ms_o365_message_trace.py", line 72, in collect_events input_module.collect_events(self, ew) File "/opt/splunk/etc/apps/TA-MS_O365_Reporting/bin/input_module_ms_o365_message_trace.py", line 57, in collect_events r = requests.get(microsoft_trace_url, auth=requests.auth.HTTPBasicAuth(global_microsoft_office_365_username, global_microsoft_office_365_password)) File "/opt/splunk/etc/apps/TA-MS_O365_Reporting/bin/ta_ms_o365_reporting/requests/api.py", line 70, in get return request('get', url, params=params, **kwargs) File "/opt/splunk/etc/apps/TA-MS_O365_Reporting/bin/ta_ms_o365_reporting/requests/api.py", line 56, in request return session.request(method=method, url=url, **kwargs) File "/opt/splunk/etc/apps/TA-MS_O365_Reporting/bin/ta_ms_o365_reporting/requests/sessions.py", line 488, in request resp = self.send(prep, **send_kwargs) File "/opt/splunk/etc/apps/TA-MS_O365_Reporting/bin/ta_ms_o365_reporting/requests/sessions.py", line 609, in send r = adapter.send(request, **kwargs) File "/opt/splunk/etc/apps/TA-MS_O365_Reporting/bin/ta_ms_o365_reporting/requests/adapters.py", line 497, in send raise SSLError(e, request=request) SSLError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:676) Why is this failing? And where do I start to fix it? Thanks. ... View more

HI, I recently deployed Splunk Enterprise Security 4.5 into a Search Head Cluster and whenever I use the Splunk App for Unix and Linux, I am getting the below error from all indexers: [PROD-XX-X] Empty csv lookup file (contains only a header) for table 'asset_lookup_by_cidr': /opt/splunk/var/run/searchpeers/57E9834B-43B4-41D0-A3BD-042A352C4C79-1480672942/apps/SA-IdentityManagement/lookups/assets_by_cidr.csv After investigations using http://docs.splunk.com/Documentation/ES/4.5.0/User/AssetandIdentityMerging the assets_by_cidr.csv does not get updated as the search that populates it returns no values. It looks like it is meant to be empty, at least on this system, due to missing cidr information on the asset list. How can I stop this error appearing whenever I use the Splunk App for Unix and Linux on a SH cluster? Thanks ... View more