@Viacheslav There should be internal logs that can help index=_internal source="/opt/splunk/var/log/splunk/Splunk_TA_github_utils.log"   I would take the output from that and open a support case with Splunk Support. ... View more

@Viacheslav The add-on is the data collection mechanism. If you are using GitHub SaaS, it can poll the API for the audit logs OR you can use the Audit Log streaming built into GitHub and use the sourcetype that is included in the Add-on. If you are using GitHub Enterprise Server or their on-prem product, you'll send the syslog data to a Splunk Connect for Syslog endpoint that takes advantage of the sourcetypes in the add-on. The App is the visualization component and is only there to provide out of the box dashboards and alerts. I like to refer to the documentation in the GitHub repo for the App for how to set up different configurations based on your specific needs: https://github.com/splunk/github_app_for_splunk/ If that doesn't help, please feel free to message or email me directly. ... View more

@indreshdowjones  For the audit related dashboards, the only macro needed to be modified is the `github_source` macro. And for you I'd probably update it to just read as (index="github" source="http:github_token") ... View more

based on the inclusion of graphql in the URL, I'm going to guess you changed the hostname in the config. For pretty much everyone, the hostname should stay as api.github.com. If you update that and are still getting errors, please reach out via email derkkila at splunk.   ... View more

Almost everyone will use the default hostname for the API, so that shouldn't be changed. If you are a GitHub Enterprise Cloud customer, the account type will be "enterprise". However if you are using a paid GitHub organization at the "GitHub Enterprise" billing tier, you'll enter "organization" for the account type. For an easy way to tell, go to your user icon in the upper right corner and if the menu includes an entry called "Your Enterprises", then you are a GitHub Enterprise Cloud customer, otherwise you are a paid Organization. The Enterprise name is the name of the  Enterprise or Organization that you are a member of. This can be found in the URL, something like "https://github.com/**Enterprise Name". To troubleshoot the Add-On I recommend looking at index=_internal and including the string "ghe" in the search to look for errors from the Add-On. If there is an error, there should be a message with a status code in the logs. ... View more

Hi @Maaz , the dashboards for the GitHub App for Splunk use a macro to make it easy to use, so once the data is being indexed by the Add-On, you should update the Macro in the App to point to the index the data is being stored in.  ... View more

I am still looking for someone to test the app out. If you'd like you can email me using my handle. ... View more

I have a version that is using Python 3 that needs additional validation, if you're using Bitbucket Cloud, I'd like to work with you to see if it fits your needs. ... View more