Does the Microsoft Cloud Services add-on support MSAL? We're currently using it to collect resource logs from Azure, but the application we're using still uses ADAL which is no longer supported and may stop working. We'll need to migrate the azure app to MSAL, but I don't see anything in the add-ons documentation mentioning ADAL or MSAL or their support? I am wondering if the add-on cares how we create the application in Azure? Or can we use the new MSAL app in place of the ADAL one with no issues? ... View more

I'm trying to configure a cloudwatch logs input but I continue to receive invalid key errors when restarting Splunk on the HF. I've gone by the doc as well as opened a support case but haven't had success. The samples that I've seen and the keys that the support guy were telling me to try are all different than the documentation. I'm starting to think this input type is just bugged and doesn't work at all. Has anyone been able to configure this type of input? And if so, do you mind sharing what you did?   Errors   Invalid key in stanza [aws_cloudwatch_logs://REDACTED] in /opt/splunk/etc/apps/Splunk_TA_aws/local/inputs.conf, line 34: account (value: REDACTED). Invalid key in stanza [aws_cloudwatch_logs://REDACTED] in /opt/splunk/etc/apps/Splunk_TA_aws/local/inputs.conf, line 35: groups (value: /blah/blah/redacted, /blah/more/redacted). Invalid key in stanza [aws_cloudwatch_logs://REDACTED] in /opt/splunk/etc/apps/Splunk_TA_aws/local/inputs.conf, line 38: region (value: us-east-1).     Details Splunk Enterprise 8.1.4 AWS add-on 5.0.3 Installed on Amazon Linux Doc:  https://docs.splunk.com/Documentation/AddOns/released/AWS/CloudWatchLogs My current stanza   [aws_cloudwatch_logs://REDACTED] account = REDACTED groups = /blah/blah/redacted, /blah/more/redacted index = staging sourcetype = aws:cloudwatchlogs:log interval = 1800 region = us-east-1 disabled = 0       ... View more

Disclaimer: This is an issue with VMware and not Splunk. But looking to see if others in the community have seen the same issue. Our infrastructure team has recently upgraded VMware to v7. We immediately started receiving an additional terabyte of logs from their hosts. They have a support case open with the vendor to figure out why, and the vendor agrees that this is not normal and we shouldn't have seen this volume spike. They're leaning more towards a misconfiguration than a bug. They're also wondering if others in the community have seen the same from VMware v7, and if so how was it handled. Has anyone who is using v7 of VMware seen the logging spike? If so, how did you resolve it?  ... View more

I need help creating an alert action to run a simple bash script.  I created a custom app with a local/alert_actions.conf file. I have the script in the /opt/splunk/bin/scripts/ directory, but its not being called. I've tried the full path as well as the filename and I'm seeing the following errors both ways. I can run the script manually from the cli and it works fine. I'm wondering what I'm missing?      [test_custom_alert_action] is_custom = 1 label = testing the custom alert action description = Send splunk event data to a script #alert.execute.cmd = /opt/splunk/bin/scripts/test-script-action.sh alert.execute.cmd = test-script-action.sh     Errors     06-15-2021 16:33:11.603 -0500 ERROR sendmodalert - action=test_custom_alert_action - Failed to find alert.execute.cmd "test-script-action.sh". and 06-15-2021 16:30:12.352 -0500 ERROR sendmodalert - action=test_custom_alert_action - Failed to find alert.execute.cmd "/opt/splunk/bin/scripts/test-script-action.sh".       I'll also need to add arguments to send results to the script. I know I'll need to use alert.execute.cmd.arg.0 but I figured I'd just get the script working first.  ... View more

We migrated the MSCS TA to a new HF and are receiving authentication errors even though we're using the same client id, secret, and tenant id. I'm thinking its likely something network related and the auth error is misleading. I'm trying to find out exactly what URL(s) I need to whitelist - I cant find anything in the docs. Here is the error: "REST Error [400]: Bad Request -- Account authentication failed. Please check your credentials and try again". Like I said, I am using the same credentials, just a different host. Thanks. ... View more

Depending on what month it is I need to run a different sub-search. index=foo source=bar [| inputlookup servers.csv where myfield="this" | eval nowMonth=strftime(now(), "%m") | where nowMonth=06 | eval host=name | fields host] [| inputlookup servers.csv where myfield="that" | eval nowMonth=strftime(now(), "%m") | where nowMonth!=06 | eval host=name | fields host] So basically if its the current month I want to run the first inputlookup, and if its NOT the current month I want to run the 2nd inputlookup. is this doable? ... View more