We are running in Splunk Cloud and have configured the "Splunk Add-On for Microsoft Cloud Services" based on the provided configuration documentation. I am trying to use the Microsoft Azure App for Splunk to view Azure data (which I presumed would be pulled in by the "Splunk Add-On for Microsoft Cloud Services", but the Microsoft Azure App for Splunk shows no data at all. I have verified the Add-on configuration, but still not seeing any data?  Does anyone have this app working and displaying results? Best regards, Steve Rogers     ... View more

Hello, We are configuring the Splunk add-on for Microsoft Cloud Services.  Is there a corresponding Splunk app for visualization of the data that is ingested by this add-on?   Steve Rogers ... View more

I am trying to import "LEEF" formatted data (from an IBM mainframe) into Splunk, but none of the name / value pairs are recognized. There is question in Splunk community from 2011 regarding this same issue which was not answered. Should I just use the manual field extraction for this type of data or is this a known log format which Splunk can handle? See sample log event below: "LEEF:1.0|IBM|RACF|2.2.1|80 27.0|devTimeFormat=yyyy-MM-dd'T'HH:mm:ss.SSSZ devTime=2017-02-27T14:01:47.630-0500 usrName=U020005 name=LISA DODARO usrPriv= usrGroups= ICTXname= ICTXreg= job=JB0 27 Feb 2017 14:01:46.26 U0200051 intent= allow= class=MXADMIN prof= res= vol= dsn= sens= own= box= terminal= poe= logstr=CSQH RESLEVEL CHECK PERFORMED AGAINST PROFILE(MQGP.RESLEVEL), CLASS(MXADMIN), ACCESS EQUATES TO (NONE) auth= desc=Success reason= appl= sum=RACF GENERAL success for U020005: logstr=CSQH RESLEVEL CHECK PERFORMED AGAINST PROFILE(MQGP.RESLEVEL), CLASS(MXADMIN), ACCESS EQUATES TO (NONE) cmd=" ... View more

I have a directory with a list of files as follows: /var/log/xxxxx/job01_SubsLoadAdHocBC01.log /var/log/xxxxx/job01_SubsLoadDataChangeBC01.log /var/log/xxxxx/job01_SubsLoadDistributionChangeBC01.log /var/log/xxxxx/job01_SubsLoadMarketBC01.log /var/log/xxxxx/job01_SubsPrepareBC01.log /var/log/xxxxx/job01_SubsQuickJobsBC01.log /var/log/xxxxx/ScheduleSplit.log /var/log/xxxxx/job02_SubsLoadAdHocBC02.log /var/log/xxxxx/job02_SubsLoadDataChangeBC02.log /var/log/xxxxx/job02_SubsLoadDistributionChangeBC02.log /var/log/xxxxx/job02_SubsLoadMarketBC02.log /var/log/xxxxx/job02_SubsPrepareBC02.log /var/log/xxxxx/job02_SubsQuickJobsBC02.log My inputs.conf file: [monitor:///var/log/xxxxx] index = test crcSalt = sourcetype = test disabled = false blacklist = (/nodeagent|/dmgr|/ffdc) whitelist = (ScheduleSplit\.log$|job*\.log$) However, none of the files are being indexed. There are events in those files for today. I added the "crcSalt = " parameter, but that did not help. The only relevant messages I see in the splunkd.log are as follows: 0-14-2014 15:41:56.843 -0400 WARN ulimit - Core file generation disabled I am not sure what that means. Any help would be appreciated. Is this a problem with the "whitelist" statement? Steve Rogers ... View more

Is there a version of this app that is compatible with Splunk version 6? ... View more