About StevenD

StevenD

Recently upgraded to v 1.1.11 from previous 1.1.08. The posts do not format correctly on the Web and Windows Teams client. They appear to be truncated to a narrow setting. We had to alter the Microsoft Workflow we are using for the webhook to post-process the JSON sent from Splunk . 1. Need to update the version to 1.5 - "version":"1.5", 2. Need to add the following field / array. - "msteams":{"width":"Full"} I was able to do this using a compose and set variable function Compose setProperty(setProperty(variables('Body'), 'msteams', json('{"width":"full"}')), 'version', '1.5') StevenD_2-1786536502038.png Example of issue here: Normal post (in fat client GUI) ... notice right hand side gap when client is full screen mode (similar on web). StevenD_1-1786535932923.png After JSON changes. StevenD_0-1786535774043.png

StevenD · ‎11-22-2024

For anyone else that stumbles upon this, I ended up working with infoblox support on this. The issue was in the way the Infoblox Data Connector was writing the timestamp in the logs prior to sending to Splunk. Depending on your grid timezone settings, the IB Data Connector was actually offsetting the epoch time... instead of leaving it epoch. (don't ask me why). They pushed a patch down a few days ago that fixed it for us.

StevenD · ‎08-22-2024

Experiencing exact same issue with a similar configuration Infoblox Dataconnector -> HF -> Splunk Cloud (IN) ... Before I go banging my head against conf files, did you ever find a solution? Like you mentioned, the data seems pre-cooked by the Infoblox "thing"

StevenD · ‎05-28-2024

Haha yeah I guess so, fwiw I see both on ours... Some processes are suspended when they crash others just crash and vanish from task manager. Truthfully i'm not sure what the difference is between that behavior is.

StevenD · ‎05-28-2024

Unfortunately, support has been slow to get us a patched version or 9.2.2 ahead of it's general release. They said that 9.2.2 release was being pushed back. I dunno, still in a holding pattern on my end. That's concerning to hear that it didn't work for you... the "suspended behavior" is what i'm seeing on the existing 9.2.1 version.

StevenD · ‎05-13-2024

Well.... I appreciate you helping me confirm it's just 2022 😄

StevenD · ‎05-12-2024

It's an interesting thought, though the same issue is occuring on 9.0.1 for me but on Server2022

StevenD · ‎05-11-2024

According to Splunk on our case, version 9.2.2 will have a fix for this and it'll be released on 5/24. They also have a custom build available that'll solve it were going to try next week.

StevenD · ‎05-04-2024

Anecdotal but I found a few other log shoveling vendors appeared to have similar issues with the Forwarded log and Server 2022. Agent crashing/restarting constantly, but they seem to have patched their problems already. Fix Windows eventchannel forwarded events by nbertoldo · Pull Request #20594 · wazuh/wazuh (github.com) [Winlogbeat] Repeated warnings · Issue #36020 · elastic/beats (github.com) Interesting at least.

StevenD · ‎05-02-2024

Yep Server 2022 was the only outlier for us. The issue was consistent across a few 9.x UF versions as well. 9.01, 9.1.0 and 9.2.1 All had the same behavior on Server 2022 but not older win server platforms. Honestly if my infrastructure wasn't already up and running on 2022 I'd downgrade to 2019.

StevenD · ‎05-02-2024

Yeah, we have 14 servers acting as our WEF environment all with the same UF version and conf pushed out from central management/deployment. There are 6 that are Server 2016, 4 are Server 2019, and another 4 are Server 2022. Only the Server 2022 boxes have this issue. I've messed around with various .conf settings trying to bandaid it and only "current_only = 1" seems to make a difference I've packed up procmon pml and .dmp files for support to look at... dunno if there's a fix possible.... I'll post back if I hear anything.

StevenD · ‎05-02-2024

A temporary workaround that worked for us was setting current_only to 1 and restarting the forwarder.... Splunk-wineventlog.exe still crashes and restarts, but it does at least read some events and send them before it does.

StevenD · ‎03-19-2024

I'm seeing errors similar to below whenever the Resources -> Subscription input is configured and the TA doesn't pull data. ValueError("Parameter 'subscription_id' must not be None.") ValueError: Parameter 'subscription_id' must not be None. You can only add the "subscription id" in the GUI while creating a new input and when you save the config it immediately blanks out that field.... I wouldn't assume you'd need a subscription id to pull data for all subscriptions in a tenant anyways … Either way it's busted. Has anyone gotten the "Subscriptions" input to work successfully? Does anyone know if this is a known bug? Splunk Add-on for Microsoft Cloud Services

Posts	13
Solutions	0
Karma Given	0
Karma Received	1
Member Since	‎11-18-2022

Online Status	Offline
Date Last Visited	2 weeks ago

Splunk Alerts for Microsoft Teams - Does not forma...

Splunk Add-on for Microsoft Cloud Services - Subsc...

Splunk Alerts for Microsoft Teams - Does not forma...

Re: Infoblox timezone not changing

Re: Infoblox timezone not changing

Re: splunk-winevtlog.exe keeps crashing on Windows...

Re: splunk-winevtlog.exe keeps crashing on Windows...

Re: splunk-winevtlog.exe keeps crashing on Windows...

Re: splunk-winevtlog.exe keeps crashing on Windows...

Re: splunk-winevtlog.exe keeps crashing on Windows...

Re: splunk-winevtlog.exe keeps crashing on Windows...

Re: splunk-winevtlog.exe keeps crashing on Windows...

Re: splunk-winevtlog.exe keeps crashing on Windows...

Re: splunk-winevtlog.exe keeps crashing on Windows...

Splunk Add-on for Microsoft Cloud Services - Subsc...

Join the Conversation