1) props.conf for sourcetype [sailpoint_identitynow], TIME_PREFIX is correct with "created" field, TIME_FORMAT is incorrect, possibly needs a ".%Q" added for milliseconds, and DATETIME_CONFIG is preempting all other settings and setting the timestamp as _indextime. I fixed it on both our HF & Cloud instance by removing both TIME_FORMAT & DATETIME_CONFIG. 2) The app isn't compatible with Splunk versions 9.x, both Cloud & Enterprise, so for our fully-managed-by-Splunk version of Splunk Cloud running on 9.3.x we can't install the app at all. 3) ISC configuration settings (org name, client ID & client secret) are required in 2 different places?!?! Config tab needs to be filled in otherwise Input doesn't work. No support for multiple orgs? We are currently connected with our dev org, however anticipating a problem of adding a production org in the very near future, would need to have the TA installed on 2 different HFs? ... View more

Using Microsoft Azure Add-on for Splunk v 3.0.0, have successfully gotten events from AD & Event Hub and now we are now attempting to get Security Center Alerts & Tasks but we're getting the following stack trace:     2020-12-09 22:24:55,806 ERROR pid=31658 tid=MainThread file=base_modinput.py:log_error:309 | Get error when collecting events. Traceback (most recent call last): File "/opt/splunk/etc/apps/TA-MS-AAD/bin/ta_ms_aad/aob_py3/modinput_wrapper/base_modinput.py", line 128, in stream_events self.collect_events(ew) File "/opt/splunk/etc/apps/TA-MS-AAD/bin/azure_security_center_input.py", line 88, in collect_events input_module.collect_events(self, ew) File "/opt/splunk/etc/apps/TA-MS-AAD/bin/input_module_azure_security_center_input.py", line 83, in collect_events if (this_changedTime > max_asc_task_date): TypeError: '>' not supported between instances of 'str' and 'NoneType'     Our app has "Reader" permissions in Azure which fixed a 403 error before we got to this point, and its very likely that this error is related to a permission setting somewhere in Azure (potentially similar to this solved question). This error is only happening for Security TASKs, though we are not getting any events for Security Alerts either when one is enabled and the other is disabled. ... View more