Can anyone help with these errors? Clicking Configuration brings this error. Configuration page failed to load, the server reported internal errors which may indicate you do not have access to this page. Error: Request failed with status code 500 ERR0002 Then, this occurs when I try and configure a new input, selecting either option, O365 Email Groups, or O365 email.       Error response received from server: Unexpected error "<class 'splunktaucclib.rest_handler.error.RestError'>" from python handler: "REST Error [500]: Internal Server Error -- Traceback (most recent call last): File "/opt/splunk/etc/apps/TA_microsoft_o365_email_add_on_for_splunk/bin/ta_microsoft_o365_email_add_on_for_splunk/aob_py3/splunktaucclib/rest_handler/handler.py", line 124, in wrapper for name, data, acl in meth(self, *args, **kwargs): File "/opt/splunk/etc/apps/TA_microsoft_o365_email_add_on_for_splunk/bin/ta_microsoft_o365_email_add_on_for_splunk/aob_py3/splunktaucclib/rest_handler/handler.py", line 345, in _format_all_response self._encrypt_raw_credentials(cont["entry"]) File "/opt/splunk/etc/apps/TA_microsoft_o365_email_add_on_for_splunk/bin/ta_microsoft_o365_email_add_on_for_splunk/aob_py3/splunktaucclib/rest_handler/handler.py", line 375, in _encrypt_raw_credentials change_list = rest_credentials.decrypt_all(data) File "/opt/splunk/etc/apps/TA_microsoft_o365_email_add_on_for_splunk/bin/ta_microsoft_o365_email_add_on_for_splunk/aob_py3/splunktaucclib/rest_handler/credentials.py", line 293, in decrypt_all all_passwords = credential_manager._get_all_passwords() File "/opt/splunk/etc/apps/TA_microsoft_o365_email_add_on_for_splunk/bin/ta_microsoft_o365_email_add_on_for_splunk/aob_py3/solnlib/utils.py", line 128, in wrapper return func(*args, **kwargs) File "/opt/splunk/etc/apps/TA_microsoft_o365_email_add_on_for_splunk/bin/ta_microsoft_o365_email_add_on_for_splunk/aob_py3/solnlib/credentials.py", line 281, in _get_all_passwords clear_password += field_clear[index] TypeError: can only concatenate str (not "NoneType") to str ". See splunkd.log/python.log for more details. ... View more

I have the Splunk Add-on for Microsoft Office 365 app running and collecting all of the inputs successfully with t he exception of the Audit Logs input. I have it collecting logs from multiple O365 tenants, and all of them have  the same errors with  the  Audit Log Input. The _internal  log has the errors indicating its an issue with the username and  credentials. This app doesn't using credentials, it uses keys.  The keys for the Azure app are valid, and not expired.  I can log in successfully to the tenant with the same credentials that are show in the error message. The error is below and has been sanitized. 2022-03-30 09:10:08,938 level=DEBUG pid=8229 tid=MainThread logger=splunk_ta_o365.modinputs.graph_api.GraphApiConsumer pos=GraphApiConsumer.py:_ingest:79 | datainput=b'se_audit_log_signins' start_time=1648645805 | message="ingesting message " message=graphApiMessage(id='XXXXXXXX-YYYY-XXX5-YYYY-ZZZZZZZZ', update_time=datetime.datetime(2022, 3, 30, 13, 10, 8, 751629), data='{"id": "XXXXXXXX-aXX-4cXXX-XXXX-XXXXXXXX", "createdDateTime": "2022-03-29T14:44:07Z", "userDisplayName": "XXXX XXXX", "userPrincipalName": "XXXX@YYYY.com", "userId": "XXXXXXXXXXXXXXXXXX", "appId": "00000002-0000-0ff1-ce00-000000000000", "appDisplayName": "Office 365 Exchange Online", "ipAddress": "123.123.122.123", "clientAppUsed": "Reporting Web Services", "correlationId": "XXXXXXXX-YYYY-ZZZZ-QQQQQQQQ", "conditionalAccessStatus": "notApplied", "isInteractive": true, "riskDetail": "none", "riskLevelAggregated": "none", "riskLevelDuringSignIn": "none", "riskState": "none", "riskEventTypes": [], "riskEventTypes_v2": [], "resourceDisplayName": "Office 365 Exchange Online", "resourceId": "XXXXXXXX-0000-0XXX-XX00-000000000000", "status": {"errorCode": 50126, "failureReason": "Error validating credentials due to invalid username or password.", "additionalDetails": "The user didn\'t enter the right credentials. \\u00a0It\'s expected to see some number of these errors in your logs due to users making mistakes."}, "deviceDetail": {"deviceId": "", "displayName": "", "operatingSystem": "", "browser": "Python Requests 2.22", "isCompliant": false, "isManaged": false, "trustType": ""}, "location": {"city": "somewhere", "state": "XXXXXX", "countryOrRegion": "US", "geoCoordinates": {"altitude": null, "latitude": XX.XXXX, "longitude": -XX.XXXX}}, "appliedConditionalAccessPolicies": []}', key='XXXXXX-XXXX-XXXX-XX-XXXXXXXXX')   Any thoughts?  Its working for all other inputs. Thanks, Robert     ... View more

The PAVO  Splunk app  Source Profile & Destination Profile dashboards appear to  be missing a macro.  This is the error. A search for the macro was unsuccessful. Error in 'SearchParser': The search specifies a macro 'apl_aut_tstats' that cannot be found. Reasons include: the macro name is misspelled, you do not have "read" permission for the macro, or the macro has not been shared with this application. Click Settings, Advanced search, Search Macros to view macro information. Can anyone who has this Splunk app installed check and see if it does exist in their installation? Thanks Robert   ... View more

I have a field that consists of data separated from a json  data field using this search. index="test-99" sourcetype="csv"   | eval AuditData_keys = json_keys(AuditData)  ths works perfectly and creates the field called AuditData_keys The data in field AuditData_keys in unique based on the values in a field called operations. There are 39 unique values, each with its own unique set of fields.  I'm trying to export each value of the operations field into distinct fields per value. My initial idea was to have individual eventtypes for each operations value. The issue I'm having is what is the best way to extract the fields as they contain similar fields as well as additional fields for each operation value. I came up with this search to create a value for each value in the operations field and its relevant data fields. index="test-99" sourcetype="csv" | eval AuditData_keys = json_keys(AuditData)| table Operations AuditData_keys | dedup AuditData_keys| outputcsv AuditData_extracted_fields_unique.csv Here is a sample of one operation value and its fields. Operation value       Values(fields)  from the AuditData_key UserLoginFailed ["CreationTime","Id","Operation","OrganizationId","RecordType","ResultStatus","UserKey","UserType","Version","Workload","ClientIP","ObjectId","UserId","AzureActiveDirectoryEventType","ExtendedProperties","ModifiedProperties","Actor","ActorContextId","ActorIpAddress","InterSystemsId","IntraSystemId","SupportTicketId","Target","TargetContextId","ApplicationId","DeviceProperties","ErrorNumber","LogonError"]   Short of manually typing the fields for each operation value and using the strings command, there has to be a more efficient way. This is o365 audit data extracted with powershell as a csv file that has embedded json data. Thanks in advance Robert       ... View more

Hello, I've tried to get this app working for a small tenant but have been unsuccessful. I'm getting secret errors in the log files. Can anyone help?  I have confirmed that the secret is correct for the application. 2021-04-25 23:26:01,469 ERROR pid=5900 tid=MainThread file=base_modinput.py:log_error:309 | Get error when collecting events. Traceback (most recent call last): File "F:\Splunk\etc\apps\TA_microsoft_o365_email_add_on_for_splunk\bin\ta_microsoft_o365_email_add_on_for_splunk\aob_py3\modinput_wrapper\base_modinput.py", line 128, in stream_events self.collect_events(ew) File "F:\Splunk\etc\apps\TA_microsoft_o365_email_add_on_for_splunk\bin\o365_email.py", line 132, in collect_events input_module.collect_events(self, ew) File "F:\Splunk\etc\apps\TA_microsoft_o365_email_add_on_for_splunk\bin\input_module_o365_email.py", line 185, in collect_events access_token = _get_access_token(helper) File "F:\Splunk\etc\apps\TA_microsoft_o365_email_add_on_for_splunk\bin\input_module_o365_email.py", line 64, in _get_access_token CURRENT_TOKEN = access_token[ACCESS_TOKEN] KeyError: 'access_token' ... View more