I have configured the microsoft 365 office 365, all are working except message trace. I rebuilt the input but still getting this error message when checking the internal logs. all other exchange mailbox data is coming in and all use the same acct. ... View more

We have been using the sentinelone app for splunk cloud for over year lately we are getting the below error. Tried regenerating the api key, no joy error_message="[HTTP 404] https://127.0.0.1:8089/servicesNS/nobody/sentinelone_app_for_splunk/configs/conf-authhosts/278c8-73f2-d67a-0211-782344bd8727?output_mode=json" error_type="<class 'splunk.ResourceNotFound'>" error_arguments="[HTTP 404] https://127.0.0.1:8089/servicesNS/nobody/sentinelone_app_for_splunk/configs/conf-authhosts/278c8-73f2-d67a-0211-782344bd8727?output_mode=json" error_filename="s1_client.py" error_line_number="164" input_guid="f6cf841-8787-761-d820-d0d36cebfa" input_name="Activity" Error filename: s1_client.py Error line number: 164 Input guid: f6cf841-8787-761-d820-d0d36cebfa Message: [HTTP 404] https://127.0.0.1:8089/servicesNS/nobody/sentinelone_app_for_splunk/configs/conf-authhosts/278c8-73f2-d67a-0211-782344bd8727?output_mode=json   ... View more

Is there a way to export the content management list to excel? I want to go over them with my team and it would be faster to have the full list of objects to determine what we want to enable. ... View more

Im trying to get specific results if two values in the same field are true but I keep failing I want to count the number of times a  sc_action=REQ_PASSED when sc_action=REQ_CHALLENGE_CAPTCHA was required   I tried this : My search | eval activity=if(IN(sc_action, "REQ_CHALLENGE_CAPTCHA", "REQ_PASSED")"passed","captcha") | stats count by activity I tried if/where and evals, I either get get an error or I get all the results where both are true. Maybe im overthinking it ... View more

Im trying to show what users logged into AWS with an assigned role and what they accessed/changed. Is there a specific AWS audit log I need to have ingested? We have people making changes with no documentation of when they did a change or when they logged in. ... View more

We have cisco ios logs going to our syslog server > heavy forwarder > Splunk cloud. The addon is installed on the syslog server UF, heavy forwarder and search head. Data is being parsed correctly however for dvc all we get is the syslog server. Is there something we need to configure on the addon to get the actual cisco device name? ... View more

I have sanitized the index names- I have users that have propagated a lookup command in dashboards that is now a major issue with the lookup file being so large now its causing bundle replication errors (lookup table is a whopping 512mb). They do not have an append=true in their dashboards and personally in my opinion its bad practice to create a lookup table using a dashboard but to use a scheduled search instead and reference in the dashboard. Id like a few sets of eyes on this and do a sanity check or am i looking at this totally wrong? BTW do i need commas to separate the field value's? The user want just certain values updated when run every 15 mins - " pcenter office externalIP" Their lookup command within the dashboard - | lookup agentsessions.csv sessionId OUTPUTNEW pcenter office externalIP Now, my theory is they wanted to update  just the data in the fields for pcenter, office, and  externalIP. IIRC the OUTPUTNEW command is used to fill a field that previously had no data (was blank) The OUTPUT command IIRC replaces the specified data with the new data so the new dashboard command should look like this :   | lookup agentsessions.csv sessionId OUTPUT pcenter office externalIP. I created a scheduled search which should update the whole table (renamed it for testing) index IN (one, two, three, four) source="wineventlog:custom SourceName=DesktopAgentService action timestamp sessionId Heartbeat | table Message | spath input=Message | dedup sessionId sortby +_time | lookup agentsessions2.csv sessionId OUTPUT sessionId as existingSessionId | where isnull(existingSessionId) | fields - action existingSessionId Message | outputlookup agentsessions2.csv append=true OR I clould modifiy the scheduled search like this: index IN (one, two, three, four) source="wineventlog:custom" SourceName=DesktopAgentService action timestamp sessionId Heartbeat | table Message | spath input=Message | dedup sessionId sortby +_time | lookup agentsessions2.csv sessionId OUTPUT sessionId as existingSessionId pcenter office externalIP | where isnull(existingSessionId) | fields - action existingSessionId Message | outputlookup agentsessions2.csv append=true Also, with the append=true, wont that duplicate entries each time it is ran? or will it just update the table with new fresh data? Ran both my scheduled searches and they do seem to work, I just want to verify I am doing it correctly and getting the updated data instead of them trying to do all this in a dashboard that runs every 15 mins. Or should I have them create a dataset table to do all this more efficiently? https://docs.splunk.com/Documentation/Splunk/9.0.4/Knowledge/Aboutdatasets ... View more