HI guys, I try to add new license Splunk on WebUI and CLI, Both Failed. On CLI, I see error /opt/splunk/etc/licenses/enterprise/24.7.License: failed to parse license because: The license payload seems to be empty On WebUI, when I add I get 500 Error, on search following recommend on error page  index=_internal host="monitor*" source=*web_service.log log_level=ERROR requestid=666fdcbe397fd164249e90 I get this 2024-06-17 13:50:38,231 ERROR [666fdcbe397fd164249e90] error:338 - Traceback (most recent call last): File "/test1/opt/splunk/lib/python3.7/site-packages/cherrypy/_cprequest.py", line 628, in respond self._do_respond(path_info) File "/test1/opt/splunk/lib/python3.7/site-packages/cherrypy/_cprequest.py", line 680, in _do_respond self.body.process() File "/test1/opt/splunk/lib/python3.7/site-packages/cherrypy/_cpreqbody.py", line 982, in process super(RequestBody, self).process() File "/test1/opt/splunk/lib/python3.7/site-packages/cherrypy/_cpreqbody.py", line 559, in process proc(self) File "/test1/opt/splunk/lib/python3.7/site-packages/cherrypy/_cpreqbody.py", line 225, in process_multipart_form_data process_multipart(entity) File "/test1/opt/splunk/lib/python3.7/site-packages/cherrypy/_cpreqbody.py", line 217, in process_multipart part.process() File "/test1/opt/splunk/lib/python3.7/site-packages/cherrypy/_cpreqbody.py", line 557, in process self.default_proc() File "/test1/opt/splunk/lib/python3.7/site-packages/cherrypy/_cpreqbody.py", line 717, in default_proc self.file = self.read_into_file() File "/test1/opt/splunk/lib/python3.7/site-packages/cherrypy/_cpreqbody.py", line 731, in read_into_file fp_out = self.make_file() File "/test1/opt/splunk/lib/python3.7/site-packages/cherrypy/_cpreqbody.py", line 513, in make_file return tempfile.TemporaryFile() File "/test1/opt/splunk/lib/python3.7/tempfile.py", line 586, in TemporaryFile prefix, suffix, dir, output_type = _sanitize_params(prefix, suffix, dir) File "/test1/opt/splunk/lib/python3.7/tempfile.py", line 126, in _sanitize_params dir = gettempdir() File "/test1/opt/splunk/lib/python3.7/tempfile.py", line 294, in gettempdir tempdir = _get_default_tempdir() File "/test1/opt/splunk/lib/python3.7/tempfile.py", line 229, in _get_default_tempdir dirlist) FileNotFoundError: [Errno 2] No usable temporary directory found in ['/tmp', '/var/tmp', '/usr/tmp', '/']  Any one know why? Thank you for your time ... View more

      2023-07-28 14:54:33,274 level=ERROR pid=80142 tid=MainThread logger=splunk_ta_o365.modinputs.message_trace pos=__init__.py:run:376 | datainput=b'message' start_time=1690530870 | message="An error occurred while collecting data" stack_info=True Traceback (most recent call last): File "/opt/splunk/etc/apps/splunk_ta_o365/bin/splunk_ta_o365/modinputs/message_trace/__init__.py", line 371, in run self._collect_events(app) File "/opt/splunk/etc/apps/splunk_ta_o365/bin/splunk_ta_o365/modinputs/message_trace/__init__.py", line 145, in _collect_events self._get_events_continuous(app) File "/opt/splunk/etc/apps/splunk_ta_o365/bin/splunk_ta_o365/modinputs/message_trace/__init__.py", line 216, in _get_events_continuous self._process_messages(start_date, end_date) File "/opt/splunk/etc/apps/splunk_ta_o365/bin/splunk_ta_o365/modinputs/message_trace/__init__.py", line 283, in _process_messages message_response = self._get_messages(microsoft_trace_url) File "/opt/splunk/etc/apps/splunk_ta_o365/bin/splunk_ta_o365/modinputs/message_trace/__init__.py", line 270, in _get_messages raise e File "/opt/splunk/etc/apps/splunk_ta_o365/bin/splunk_ta_o365/modinputs/message_trace/__init__.py", line 262, in _get_messages response.raise_for_status() File "/opt/splunk/etc/apps/splunk_ta_o365/lib/requests/models.py", line 1021, in raise_for_status raise HTTPError(http_error_msg, response=self) requests.exceptions.HTTPError: 403 Client Error: for url: https://reports.office365.com/ecp/reportingwebservice/reporting.svc/MessageTrace?$filter=StartDate%20eq%20datetime'2023-07-23T07:32:50Z'%20and%20EndDate%20eq%20datetime'2023-07-23T08:32:50Z'       Can anyone know how to fix this. I try all solutions in splunk community but its not working. Anyone can help me? Thank you for your help ... View more

Hi all, I have a big problem with my customer. I try to get message trace logs from Azure for O365, following the Splunk doc, my account have all 3 roles: Exchange Administrator  Global Administrator  Global Reader role In my lab Splunk I try to trouble shoot by _internal and I have this. Any one know why and how to fix this? this is sample log:       2023-07-08 20:00:18,077 level=ERROR pid=10564 tid=MainThread logger=splunk_ta_o365.modinputs.message_trace pos=__init__.py:run:376 | datainput=b'messagetrace' start_time=1688821215 | message="An error occurred while collecting data" stack_info=True Traceback (most recent call last): File "/opt/splunk/etc/apps/splunk_ta_o365/bin/splunk_ta_o365/modinputs/message_trace/__init__.py", line 371, in run self._collect_events(app) File "/opt/splunk/etc/apps/splunk_ta_o365/bin/splunk_ta_o365/modinputs/message_trace/__init__.py", line 145, in _collect_events self._get_events_continuous(app) File "/opt/splunk/etc/apps/splunk_ta_o365/bin/splunk_ta_o365/modinputs/message_trace/__init__.py", line 216, in _get_events_continuous self._process_messages(start_date, end_date) File "/opt/splunk/etc/apps/splunk_ta_o365/bin/splunk_ta_o365/modinputs/message_trace/__init__.py", line 283, in _process_messages message_response = self._get_messages(microsoft_trace_url) File "/opt/splunk/etc/apps/splunk_ta_o365/bin/splunk_ta_o365/modinputs/message_trace/__init__.py", line 270, in _get_messages raise e File "/opt/splunk/etc/apps/splunk_ta_o365/bin/splunk_ta_o365/modinputs/message_trace/__init__.py", line 262, in _get_messages response.raise_for_status() File "/opt/splunk/etc/apps/splunk_ta_o365/lib/requests/models.py", line 1021, in raise_for_status raise HTTPError(http_error_msg, response=self) requests.exceptions.HTTPError: 403 Client Error: for url: https://reports.office365.com/ecp/reportingwebservice/reporting.svc/MessageTrace?$filter=StartDate%20eq%20datetime'2023-07-03T12:54:27Z'%20and%20EndDate%20eq%20datetime'2023-07-03T13:54:27Z'         ... View more

Hi I want to calculate duration. For example, I have 2 different event in a source First event: 04/03/2023   PLUGIN_CLIENT_CONNECT (this is not a field in event) 17:10:15.000  Second event: 04/03/2023  PLUGIN_CLIENT_DISCONNECT  (this is not a field in event) 17:51:15.000 I want to cal duration between them. Expected result with table: Start Time            End Time            Hours Ago 04/03/2023       04/03/2023      41 minutes (and hours if have)  17:10:15.000      17:51:15.000   Anyone can help me??? Thank you for pay time   ... View more

Hi After configuring some reports in PCI, when I go back to Report, I get an error message: A custom JavaScript error caused an issuse loading your dashboard. See the developer console for more detail How to fix this error?? ... View more