About robayers

artioli · ‎08-14-2024

I'm having the same problem with the Palo Alto add-on.

VatsalJagani · ‎03-30-2022

Just make sure there is no manual code modification that has been done. To make sure you have all the right files available from the Add-on: Upgrade to the latest version (perform the upgrade even though you are already on the latest version) of the Add-on and reconfigure that particular input.

aplura_llc_supp · ‎09-22-2021

@robayersApologies for the delay, but that should be fixed in the latest release. Thanks!

robayers · ‎05-09-2021

Ideally something that is repeatable, with options that are defined in a sourcetype while importing the the downloaded csv. The imported file is downloaded on a scheduled basis. Ive created a regex that works on the regex101 website, \"(.[^\"]+) This works and detects all of the fields and puts them in groups named automatically. I'd like to use the extracted data as the fieldname without all of the typing. The regex above doesn't work in Splunk, or at least I can't make it work.

patelaa · ‎04-29-2021

@robayers I've been messing around with this app for a few days and just got it working after seeing the same errors as you. You'll want to make sure your API permissions are set correctly and admin consent is granted in Azure then double check your configuration and input settings in the app. When adding the account under configuration in the app make sure you're using the Application (Client) ID found in the Overview section in Azure rather than the Client Secrets ID, this ended up being my issue. Also check that your traffic isn't getting blocked somewhere in your network. I found another thread where someone mentioned that was their issue. I can't find it again but they said something about their firewall not liking the endpoint input option set to worldwide and they were able to get it to work by setting that to USGovGCCHigh so that may be worth trying.

robayers · ‎04-26-2021

Hello, I've tried to get this app working for a small tenant but have been unsuccessful. I'm getting secret errors in the log files. Can anyone help? I have confirmed that the secret is correct for the application. 2021-04-25 23:26:01,469 ERROR pid=5900 tid=MainThread file=base_modinput.py:log_error:309 | Get error when collecting events. Traceback (most recent call last): File "F:\Splunk\etc\apps\TA_microsoft_o365_email_add_on_for_splunk\bin\ta_microsoft_o365_email_add_on_for_splunk\aob_py3\modinput_wrapper\base_modinput.py", line 128, in stream_events self.collect_events(ew) File "F:\Splunk\etc\apps\TA_microsoft_o365_email_add_on_for_splunk\bin\o365_email.py", line 132, in collect_events input_module.collect_events(self, ew) File "F:\Splunk\etc\apps\TA_microsoft_o365_email_add_on_for_splunk\bin\input_module_o365_email.py", line 185, in collect_events access_token = _get_access_token(helper) File "F:\Splunk\etc\apps\TA_microsoft_o365_email_add_on_for_splunk\bin\input_module_o365_email.py", line 64, in _get_access_token CURRENT_TOKEN = access_token[ACCESS_TOKEN] KeyError: 'access_token'

robayers · ‎12-03-2020

That's appears to have been the problem. I removed them from the dropdown configuration and verified that they didn't exist in the search and it worked. Thanks for your help. Robert

Posts	18
Solutions	0
Karma Given	1
Karma Received	1
Member Since	‎12-02-2020

Online Status	Offline
Date Last Visited	‎05-08-2023 11:19 PM

Why am I receiving Microsoft O365 Email Add-on for...

Why does Splunk Add-on for Microsoft Office 365 ha...

PAVO DNS Splunk App

How to split up a string into multiple fields?

Microsoft O365 Email App errors

Help with output csv by combining tokens from dash...

Re: Why am I receiving Microsoft O365 Email Add-on...

Re: Why does Splunk Add-on for Microsoft Office 36...

Re: PAVO DNS Splunk App

Re: How to split up a string into multiple fields?

Re: Microsoft O365 Email Add-on for Splunk

Microsoft O365 Email App errors

Re: Help with output csv by combining tokens from ...

Join the Conversation