i need help in setting up federated search , the requirement is that i want to run some splunk search from dbconnect add-on and insert the results into a database using dbconnect output configuration. since dbconnect is not supported in splunkcloud , i am trying to find ways to achieve this,  1- can federated search be setup one-way from onprem to cloud? can 8089 work only with outbound to splunkcloud ? because we cant have inbound traffic in oprem from cloud due to org security policy ?? 2- i know api search is another way but i have no script which could put those results into a db table and that incrementally so that results are not duplicated, kind of a rising column setup as dbconnect instead for whole batch      ... View more

I have a a saved search for vpcflow logs sourcetype which searches for particular CIDR (src_ip & dest_ip) but takes almost 3 4 hrs run the query when it searches for last 6months , I want the output for external reporting , what is the best method forward to save time & resources . we dont have data models on our search head. ... View more

The app is on splunkbase published by splunklabs/splunkworks. Splunk Add-on for Microsoft Office 365 Reporting Web Service | Splunkbase The app was recently updated to use Advanced auth  but it requires  GLOBAL READER role which is really a big deal for us, also it doesn't seem appropriate  for the purpose we are using the app for(just reading web mails), is there any way we could make it work with less privilege ? The error i receive on the HF where i have installed this app - 09-19-2022 09:20:40.397 -0500 ERROR ExecProcessor - message from "/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/TA-MS_O365_Reporting/bin/ms_o365_message_trace_oauth.py" 403 Client Error: for url: https://reports.office365.com/ecp/reportingwebservice/reporting.svc/MessageTrace?$filter=StartDate%20eq%20datetime'2022-09-14T09:20:39.496008Z'%20and%20EndDate%20eq%20datetime'2022-09-14T10:20:39.496008Z It would be really appreciated if someone can help me out with this.   ... View more

We are in the process of setting up comprehensive VPN Dashboards,We would like to enable alerting on these dashboards based on machine learning and standard deviation.. Can someone help me achieve this /. ... View more

XML parsing is not working as expected, field values are truncating , tried changing truncate values in props but that doesnt help.. Tried with and without KV_MODE as well props.conf on HF [iiq_db] TRUNCATE = 100000 NO_BINARY_CHECK = true SHOULD_LINEMERGE = false category = custom pulldown_type = true KV_MODE = xml sample log   2021-09-24 14:28:29.011, id="XXXXXXX", created_dt="2021-09-24 08:18:01.87", created="1632489481870", source="RequestHandler", action="provision", target="XXXX", application="Enterprise Directory", account_name="XXXX,ou=XXXXX,ou=XXXX,ou=HO,o=XXX.com", attributes="<Attributes> <Map> <entry key="IIQDisabled"> <value> <Boolean></Boolean> </value> </entry> <entry key="accountFlag" value="ACTIVE"/> <entry key="cn" value="XXXXX"/> <entry key="dn" value="uid=XXXX,ou=XXXX,ou=XXXX,ou=HO,o=XXX.com"/> <entry key="email" value="XX@XX.com"/> <entry key="employeeNumber" value="XXXXX"/> <entry key="employeeType" value="E"/> <entry key="givenname" value="XXXXX"/> <entry key="globaluid" value="XXX"/> <entry key="mail" value="(XX0:XX1:XX3:XX0:XX0:XX0:XX0:XX0:XX0:XX0)XX@XX.com"/> <entry key="mailAccessDomain" value="HO XXX"/> <entry key="mailRoutingAddress" value="(XX0)EX"/> <entry key="mailalternateaddress"> <value> <List> <String>(XX0:XX11)S=XXXX/G=XXX/OU=XXXX.com</String> </List> </value> </entry> <entry key="XXUniqueId" value="XYZ"/> <entry key="XXaccountstatus" value="0"/> <entry key="XXlcsp1" value="XYZ"/> <entry key="XXlinteractivep1" value="XYZ"/> <entry key="XXllcp1" value="XXXXYZ"/> <entry key="XXlmaildisplayname" value="XY , AB"/> <entry key="XXlmemberof"> <value> <List> <String>cn=Passphrase-Policy-Users,ou=groups,o=XXl.com</String> </List> </value> </entry> <entry key="XXlprofilechecksum" value="XXXX"/> <entry key="XXorgmemberof"> <value> <List> <String>ou=XXX,ou=XXXX,ou=HO,o=XXl.com</String> </List> </value> </entry> <entry key="XXworkgroupmanager" value="XXXXXXX"/> <entry key="nsAccountLock" value="FALSE"/> <entry key="objectClass"> <value> <List> <String>top</String> <String>person</String> <String>organizationalperson</String> <String>inetorgperson</String> <String>mailrecipient</String> <String>universaluniqueid</String> <String>XXlorgperson</String> </List> </value> </entry> <entry key="op"> <value> <ObjectOperation>Modify</ObjectOperation> </value> </entry> <entry key="sn" value="XXXX"/> <entry key="uid" value="XXXX"/> <entry key="uidns" value="XXXX"/> <entry key="uuid" value="XXXXX"/> </Map> </Attributes> ", string1="Enterprise Directory", string2="committed"     ... View more

i am trying to parse MS-Exchange http_proxy logs with below setup in props & transforms but this doesnt seem to be working inputs.conf UF- [monitor://D:\Program Files\Microsoft\Exchange Server\V15\Logging\HttpProxy\*\*.LOG] disabled=0 recusrive=true index= exchange_index sourcetype= exchange_httpproxy ignoreOlderThan = 0d Props and transforms on SH [exchange_httpproxy] REPORT-extractfields = extractfields [extractfields] DELIMS="," FIELDS=DateTime,RequestId,MajorVersion,MinorVersion,BuildVersion,RevisionVersion,ClientRequestId,Protocol,UrlHost,UrlStem,ProtocolAction,AuthenticationType,IsAuthenticated,AuthenticatedUser,Organization,AnchorMailbox,UserAgent,ClientIpAddress,ServerHostName,HttpStatus,BackEndStatus,ErrorCode,Method,ProxyAction,TargetServer,TargetServerVersion,RoutingType,RoutingHint,BackEndCookie,ServerLocatorHost,ServerLocatorLatency,RequestBytes,ResponseBytes,TargetOutstandingRequests,AuthModulePerfContext,HttpPipelineLatency,CalculateTargetBackEndLatency,GlsLatencyBreakup,TotalGlsLatency,AccountForestLatencyBreakup,TotalAccountForestLatency,ResourceForestLatencyBreakup,TotalResourceForestLatency,ADLatency,SharedCacheLatencyBreakup,TotalSharedCacheLatency,ActivityContextLifeTime,ModuleToHandlerSwitchingLatency,ClientReqStreamLatency,BackendReqInitLatency,BackendReqStreamLatency,BackendProcessingLatency,BackendRespInitLatency,BackendRespStreamLatency,ClientRespStreamLatency,KerberosAuthHeaderLatency,HandlerCompletionLatency,RequestHandlerLatency,HandlerToModuleSwitchingLatency,ProxyTime,CoreLatency,RoutingLatency,HttpProxyOverhead,TotalRequestTime,RouteRefresherLatency,UrlQuery,BackEndGenericInfo,GenericInfo,GenericErrors,EdgeTraceId,DatabaseGuid,UserADObjectGuid,PartitionEndpointLookupLatency,RoutingStatus   ... View more