I have setup the Graph API input for AuditSignIn.Logs and logs are not consistent and missing in splunk randomly. Getting this error in logs: 2021-07-22 15:21:56,991 level=ERROR pid=8208 tid=MainThread logger=splunk_ta_o365.modinputs.graph_api pos=utils.py:wrapper:72 | datainput=b'SignInLogs' start_time=1626991803 | message="Data input was interrupted by an unhandled exception." Traceback (most recent call last): File "/opt/splunk/etc/apps/splunk_ta_o365/bin/splunksdc/utils.py", line 70, in wrapper return func(*args, **kwargs) File "/opt/splunk/etc/apps/splunk_ta_o365/bin/splunk_ta_o365/modinputs/graph_api.py", line 235, in run return consumer.run() File "/opt/splunk/etc/apps/splunk_ta_o365/bin/splunk_ta_o365/modinputs/graph_api.py", line 114, in run self._ingest(message, source) File "/opt/splunk/etc/apps/splunk_ta_o365/bin/splunk_ta_o365/modinputs/graph_api.py", line 124, in _ingest self._event_writer.write_event(message.data, source=source) File "/opt/splunk/etc/apps/splunk_ta_o365/bin/splunksdc/event_writer.py", line 161, in write_event self._write(data) File "/opt/splunk/etc/apps/splunk_ta_o365/bin/splunksdc/event_writer.py", line 145, in _write self._dev.write(data) BrokenPipeError: [Errno 32] Broken pipe Any help? ... View more

So having the idea in mind to have Alert dashboard where I can see how many alerts triggered in last 24 hours and If I can see the alert result events for the timerange it triggered. Possible? ... View more

I have a requirement to write the custom curl command and stream the output as success/fail and sendemail if the output is success. I have a python script to achieve this as pretty simple. import os result = os.popen("curl -ILk https://user-prdserver.domain.com/wrapper.json --resolve user-prdserver@domain.com:$port$:$vip$ -H 'Host:$host$' -v").read() print result  Also I have pretty good reference on how to set it up. But I am not sure how to convert this script with Splunk command requirement. so that it will be compatible in SPL and can stream the output. When I add this as it is and run from SPL as ....my search|curlit Could not locate the time (_time) field on some results returned from the external search command 'curlit'. ... View more

  I am experiencing this as a continues notification in my environment: Search peer  has the following message: The number of search artifacts in the dispatch directory is higher than recommended (count=12025, warning threshold=10000) and could have an impact on search performance. Remove excess search artifacts using the "splunk clean-dispatch" CLI command, and review artifact retention policies in limits.conf and savedsearches.conf. You can also raise this warning threshold in limits.conf what could be the key checkpoints for this investigation. I would like to find out the root cause as which user is triggering those searches or which dashboards are not optimized or any other specific reason for this? I am already running rest searches and checking schedule searches running every min but Any pointers will be helpful to make sure what are the solutions available for this.  ... View more

I would like to find out dashboards which are not optimized and each panel is triggering the independent search and consuming all resources.  Is there a splunk search to identify the dashboard so that I can educate the users to use post process searches and optimize the dashboard and resource consumptions.   ... View more

While following this https://www.splunk.com/en_us/blog/tips-and-tricks/splunking-microsoft-teams-data.html ,setup the webhook url and when trying to fetch subscription/call record data, I am getting this error in logs: 2021-01-15 15:03:15,233 INFO pid=20819 tid=MainThread file=setup_util.py:log_info:117 | Proxy is not enabled! 2021-01-15 15:03:15,584 ERROR pid=20819 tid=MainThread file=base_modinput.py:log_error:309 | Could not create subscription: 400 Client Error: Bad Request for url: https://graph.microsoft.com/beta/subscriptions In TA setup, proxy configuration needs host,port,username password. what this should be? Also where i can find the webhook URL to test the input created with teams webhook input using curl command as mentioned in the blog post. @jconger  Thanks, ... View more

I understand as per docs single value timechart command is required to put sparkline and trendline. However If I am doing the availability % of my service for example "last 24 hours" and it failed once then my sparkline shows one fall but number always shows as 100% because timechart picks the stats over latest bucket while rendering the number. Currently in Splunk its like:     But ideally I would like to show it as  my search: index=network sourcetype=nt:logs | stats count(eval('Summary.Error.Code'!="")) as failed_count count as total_count by Test,_time | eval availability = 100 - ((failed_count/total_count)*100) | table Test _time availability | timechart avg(availability) by Test Any help is appreciated. ... View more

We have multiple use case where service accounts needs to be connected through Splunk API but we want to make sure service account should not be use for Splunk web logins. Possible? ... View more