I'm running a heavy forwarder on Redhat which I recently upgraded to Splunk Enterprise 8.1.1. Most apps survived the upgrade without issue. The Splunk estreamer app (https://splunkbase.splunk.com/app/3662/) however, doesn't seem to be working anymore. It works for a little while, but then I get the following:   Monitor ERROR [ no message or attrs ] : ProxyProcess [ name=subscriberParser ] .request ( status ) timeout This is often appears soon after this: ERROR [ no message or attrs ] : ' View ' object has no attribute ' _View__isHex ' \n ' View ' object has no attribute ' _View__isHex ' Traceback ( most recent call last ) :\n File " /opt/splunk/etc/apps/TA-eStreamer/bin/encore/estreamer/baseproc.py ", line 209 , in receiveInput\n self.onReceive ( item ) \n File " /opt/splunk/etc/apps/TA-eStreamer/bin/encore/estreamer/pipeline.py ", line 350 , in onReceive\n _do ( items ) \n File " /opt/splunk/etc/apps/TA-eStreamer/bin/encore/estreamer/pipeline.py ", line 344 , in _do\n self.onEvent ( item ) \n File " /opt/splunk/etc/apps/TA-eStreamer/bin/encore/estreamer/pipeline.py ", line 338 , in onEvent\n decorate ( item [' record '], self.settings ) \n File " /opt/splunk/etc/apps/TA-eStreamer/bin/encore/estreamer/pipeline.py ", line 185 , in decorate\n settings.cache (), record ) .create () \n File " /opt/splunk/etc/apps/TA-eStreamer/bin/encore/estreamer/metadata/view.py ", line 532 , in create\n if ( self.__isHex ( hex32 )) :\nAttributeError: ' View ' object has no attribute ' _View__isHex ' \n I've tried downloading the latest version of the app, no change. To get it working again, I have to disable the 3 scripts that bring in the data, kill the PID's running the estreamer, then re-enable the scripts. Sometimes it works again for a few hours. Sometimes a few minutes. Any suggestions?  Also, something worth mentioning: I noticed when I go to manage apps, there's no "set up" option for this add on or the firepower splunk app, which is normally where I'd do the config for this.        ... View more

A couple of weeks ago, I migrated my Splunk server from one Windows Server to another. Same specs, just more capacity. However, when I look at the "License Usage - Previous 30 Days" prebuilt dashboard, the only option for "License Masters" that I have is the old server. The latest license usage data that I have is the day of the migration. I confirmed that the new server is acting as the master, with no errors. Any suggestions? ... View more

Does anyone have any guides around pulling down Dynamics 365 logs? I already have o365 logs being pulled down but I'm not seeing any Dynamics 365 data. I see in the Microsoft Office 365 App for Splunk dashboard, there's a "sourcetype="o365:service:message" WorkloadDisplayName="Dynamics 365"". However, it's not pulling anything in. Is there some documentation out there for D365 logging and ingestion? I didn't have much luck finding any. ... View more