I have a a saved search for vpcflow logs sourcetype which searches for particular CIDR (src_ip & dest_ip) but takes almost 3 4 hrs run the query when it searches for last 6months , I want the output for external reporting , what is the best method forward to save time & resources . we dont have data models on our search head. ... View more

The app is on splunkbase published by splunklabs/splunkworks. Splunk Add-on for Microsoft Office 365 Reporting Web Service | Splunkbase The app was recently updated to use Advanced auth  but it requires  GLOBAL READER role which is really a big deal for us, also it doesn't seem appropriate  for the purpose we are using the app for(just reading web mails), is there any way we could make it work with less privilege ? The error i receive on the HF where i have installed this app - 09-19-2022 09:20:40.397 -0500 ERROR ExecProcessor - message from "/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/TA-MS_O365_Reporting/bin/ms_o365_message_trace_oauth.py" 403 Client Error: for url: https://reports.office365.com/ecp/reportingwebservice/reporting.svc/MessageTrace?$filter=StartDate%20eq%20datetime'2022-09-14T09:20:39.496008Z'%20and%20EndDate%20eq%20datetime'2022-09-14T10:20:39.496008Z It would be really appreciated if someone can help me out with this.   ... View more

We are in the process of setting up comprehensive VPN Dashboards,We would like to enable alerting on these dashboards based on machine learning and standard deviation.. Can someone help me achieve this /. ... View more

XML parsing is not working as expected, field values are truncating , tried changing truncate values in props but that doesnt help.. Tried with and without KV_MODE as well props.conf on HF [iiq_db] TRUNCATE = 100000 NO_BINARY_CHECK = true SHOULD_LINEMERGE = false category = custom pulldown_type = true KV_MODE = xml sample log   2021-09-24 14:28:29.011, id="XXXXXXX", created_dt="2021-09-24 08:18:01.87", created="1632489481870", source="RequestHandler", action="provision", target="XXXX", application="Enterprise Directory", account_name="XXXX,ou=XXXXX,ou=XXXX,ou=HO,o=XXX.com", attributes="<Attributes> <Map> <entry key="IIQDisabled"> <value> <Boolean></Boolean> </value> </entry> <entry key="accountFlag" value="ACTIVE"/> <entry key="cn" value="XXXXX"/> <entry key="dn" value="uid=XXXX,ou=XXXX,ou=XXXX,ou=HO,o=XXX.com"/> <entry key="email" value="XX@XX.com"/> <entry key="employeeNumber" value="XXXXX"/> <entry key="employeeType" value="E"/> <entry key="givenname" value="XXXXX"/> <entry key="globaluid" value="XXX"/> <entry key="mail" value="(XX0:XX1:XX3:XX0:XX0:XX0:XX0:XX0:XX0:XX0)XX@XX.com"/> <entry key="mailAccessDomain" value="HO XXX"/> <entry key="mailRoutingAddress" value="(XX0)EX"/> <entry key="mailalternateaddress"> <value> <List> <String>(XX0:XX11)S=XXXX/G=XXX/OU=XXXX.com</String> </List> </value> </entry> <entry key="XXUniqueId" value="XYZ"/> <entry key="XXaccountstatus" value="0"/> <entry key="XXlcsp1" value="XYZ"/> <entry key="XXlinteractivep1" value="XYZ"/> <entry key="XXllcp1" value="XXXXYZ"/> <entry key="XXlmaildisplayname" value="XY , AB"/> <entry key="XXlmemberof"> <value> <List> <String>cn=Passphrase-Policy-Users,ou=groups,o=XXl.com</String> </List> </value> </entry> <entry key="XXlprofilechecksum" value="XXXX"/> <entry key="XXorgmemberof"> <value> <List> <String>ou=XXX,ou=XXXX,ou=HO,o=XXl.com</String> </List> </value> </entry> <entry key="XXworkgroupmanager" value="XXXXXXX"/> <entry key="nsAccountLock" value="FALSE"/> <entry key="objectClass"> <value> <List> <String>top</String> <String>person</String> <String>organizationalperson</String> <String>inetorgperson</String> <String>mailrecipient</String> <String>universaluniqueid</String> <String>XXlorgperson</String> </List> </value> </entry> <entry key="op"> <value> <ObjectOperation>Modify</ObjectOperation> </value> </entry> <entry key="sn" value="XXXX"/> <entry key="uid" value="XXXX"/> <entry key="uidns" value="XXXX"/> <entry key="uuid" value="XXXXX"/> </Map> </Attributes> ", string1="Enterprise Directory", string2="committed"     ... View more

i am trying to parse MS-Exchange http_proxy logs with below setup in props & transforms but this doesnt seem to be working inputs.conf UF- [monitor://D:\Program Files\Microsoft\Exchange Server\V15\Logging\HttpProxy\*\*.LOG] disabled=0 recusrive=true index= exchange_index sourcetype= exchange_httpproxy ignoreOlderThan = 0d Props and transforms on SH [exchange_httpproxy] REPORT-extractfields = extractfields [extractfields] DELIMS="," FIELDS=DateTime,RequestId,MajorVersion,MinorVersion,BuildVersion,RevisionVersion,ClientRequestId,Protocol,UrlHost,UrlStem,ProtocolAction,AuthenticationType,IsAuthenticated,AuthenticatedUser,Organization,AnchorMailbox,UserAgent,ClientIpAddress,ServerHostName,HttpStatus,BackEndStatus,ErrorCode,Method,ProxyAction,TargetServer,TargetServerVersion,RoutingType,RoutingHint,BackEndCookie,ServerLocatorHost,ServerLocatorLatency,RequestBytes,ResponseBytes,TargetOutstandingRequests,AuthModulePerfContext,HttpPipelineLatency,CalculateTargetBackEndLatency,GlsLatencyBreakup,TotalGlsLatency,AccountForestLatencyBreakup,TotalAccountForestLatency,ResourceForestLatencyBreakup,TotalResourceForestLatency,ADLatency,SharedCacheLatencyBreakup,TotalSharedCacheLatency,ActivityContextLifeTime,ModuleToHandlerSwitchingLatency,ClientReqStreamLatency,BackendReqInitLatency,BackendReqStreamLatency,BackendProcessingLatency,BackendRespInitLatency,BackendRespStreamLatency,ClientRespStreamLatency,KerberosAuthHeaderLatency,HandlerCompletionLatency,RequestHandlerLatency,HandlerToModuleSwitchingLatency,ProxyTime,CoreLatency,RoutingLatency,HttpProxyOverhead,TotalRequestTime,RouteRefresherLatency,UrlQuery,BackEndGenericInfo,GenericInfo,GenericErrors,EdgeTraceId,DatabaseGuid,UserADObjectGuid,PartitionEndpointLookupLatency,RoutingStatus   ... View more