About drobMT

AKomorowski · ‎09-02-2024

Hi, thanks for posting! This is definitely the plan, as we want to achieve widely understood parity between DM and AWS TA. This year, we plan to go live with AWS Org support. Next will be availability on CMP and custom source types for S3. After that, we'll take on more items to create full parity.

drobMT · ‎10-23-2020

Well 💩 . After beating my head against the wall on this... I decided to clean the index on my dev box and try this again. It's working as expected and with the props and transforms above. I think I must have been looking at old events every time I was iterating and that was confusing me. Leaving this here in case it can help someone else.

drobMT · ‎10-13-2020

Thanks! I added a /local/props.conf with [azure:aad:user] TRUNCATE = 20000 and that worked. I found by default that it was truncating at 10000. So i guessed and used 20000; that seemed to work. I then searched the most recent data pull for raw events that didn't match (looking for events without the closing "}" at the end of the JSON event). index=azuread sourcetype="azure:aad:user" | regex _raw!="\}$" When nothing matched I knew I was big enough. So I verified with index=azuread sourcetype="azure:aad:user" | eval CharCount=len(_raw) | stats max(CharCount) as maxCharCount and found my largest event (user profile) was just under 16000 characters, so 20k gives me some margin of error. Thanks for your help!

drobMT · ‎06-17-2020

I'm trying to use DBX (v3.3) to execute a stored procedure in one of our application databases. Not sure if I have a syntax problem here or not. The database is MS SQL and I can use DBX to execute queries against it so I know the connection is good. The stored proc uses the following parameters: @_StartTime (datetime, Input, No default) @_EndTime (datetime, Input, No default) @_Pool (nvarchar(256), Input, No default) @_Interval (int, Input, No default) @_WindowSize (int, Input, No default) In SQL Management Studio I can execute the following and get results (2 lines) EXEC [LcsCDR].[dbo].[CdrRegistrationSummary] @_StartTime = '20200615', @_EndTime = '20200616', @_Pool = null, @_Interval = 1440, @_WindowSize = 0; In Splunk using the following search returns no errors; no results. | dbxquery procedure="{call LcsCDR.[dbo].[CdrRegistrationSummary](?, ?, ?, ?, ?)}" connection="SkypeBackEndSQL" params="2020-06-15,2020-06-16,null,1440,0" Thoughts?

drobMT · ‎06-09-2020

Do you have access to the time created for the AccessKeyId as a field? I've calculated the age of items before using eval; the following example actually calculates the age of an EBS volume in AWS; concept is similar if you have access to the time the accesskeyid was created. | eval VolumeAgeSeconds = round(now()-strptime(create_time, "%Y-%m-%dT%H:%M:%S.%N%Z"),2), VolumeAge=tostring(VolumeAgeSeconds, "duration")

Posts	8
Solutions	1
Karma Given	3
Karma Received	1
Member Since	‎06-09-2020

Parsoning JSON arrays

Azure Add-on user data truncation

DBX executing MS SQL stored procedure

Re: Ask Questions, Get Help about Data Manager for...

Re: Parsoning JSON arrays

Re: Azure Add-on user data truncation

DBX executing MS SQL stored procedure

Re: How to pull age / time for LastAccessKeyUsed