Hello, I have a problem with a custom app in Splunk. I've written a simple app that uses the Python requests-library to query the Microsoft Graph API. It works perfectly for most queries, but when I try to use it to get all users in our AAD environment, it throws an error: ERROR ChunkedExternProcessor [111784 phase_1] - Failed to find newline while reading transport header. This always happens at the same page (I have to use pagination, since the API returns 100 lines per response). I've looked at that page, and the one after, but nothing special caught my eye. This is a Splunk-specific issue: I can use the requests-library to get all the results and the json-library to dump them with no problems, but when I use these in conjunction with splunklib and yield the results as rows, I get the error above. The logs (with debug-mode on) don't seem to have any other clues. Could this be an encoding issue - could the results have some special characters that throw the Python code off somehow? Any help is greatly appreciated! ... View more

I'm trying to use the streamstats-command with time_window to track when certain user actions happen more than twice in a span of an hour. My search is like this ("dedup _time" because we get duplicate rows) <search> | sort _time | fields _time user | dedup _time | streamstats time_window=60min count as amount by user | where amount > 2 | table _time user amount This search works correctly otherwise, but the problem is that it triggers multiple times when the user action happens more than twice in an hour. So I get results like: 2022-01-12 16:04:56.482 username1 3 2022-01-12 16:07:58.525 username1 4 2022-01-12 16:13:16.137 username1 5 2022-01-12 16:14:30.255 username1 6 So how can I get only the largest result (in this case 6) in a sequence like this? I can't use "dedup user" because the alert may trigger for the same user at some other time as well, and that should be reported as its own case. Any help is greatly appreciated. ... View more