Hello Folks I have a scripted input using -passAuth in my inputs.conf. However i've been testing the script on a *nix vm and it worked fine. (splunk 8.1). To double check the passAuth variable i printed it out to a file, copied the token and ran the following:   splunk backup kvstore -token $token_from_scripted_input   Or any command that requires auth and it worked like a charm. Doing the same now on windows and splunk 7.3.3 does not work at all as splunk keeps asking for username/pw when im using the -token option. Any ideas? ... View more

Installed the TA on  a sandbox standalone machine with splunk 7.3.3- If i try to configure stuff in the "Configuration" view, the "Accounts" tab just shows an animated circle and that's it. A restart of splunkd shows the following message: Unable to initialize modular input "microsoft_defender_atp_alerts" defined in the app "TA-MS_Defender": Introspecting scheme=microsoft_defender_atp_alerts: script running failed (exited with code 1) I reviewed all permissions on the TA and elevated permissions to read/write/execute for the splunk user and "everybody" with no effect- This installation is running on a windows server 2016 box. Anybody got an idea how to fix this? ... View more