About samejgink

samejgink · ‎07-01-2021

This is directly tied to versions of Splunk.. I just came across this today, I have recently updated a heavy forwarder from 8.0.7 to 8.2.0, my previously built apps are still working without issue. I went to create a new barebones REST API app and ran into that exact error message. I compared the folder structure of the python libraries that are tacked on when creating a new app with Add-on Builder and they were entirely different. I ended up making a copy of... /opt/splunk/etc/apps/<MY APP>/bin/ta_illinois_university_housing_api/aob_py3/httplib2/socks.py ...And placing it one directory level up. This resolved the problem, and also mimics the folder structure of my older apps. Has anyone (else!) submitted a ticket to Splunk regarding this? Thats a major bug.

samejgink · ‎12-09-2020

Using Microsoft Azure Add-on for Splunk v 3.0.0, have successfully gotten events from AD & Event Hub and now we are now attempting to get Security Center Alerts & Tasks but we're getting the following stack trace: 2020-12-09 22:24:55,806 ERROR pid=31658 tid=MainThread file=base_modinput.py:log_error:309 | Get error when collecting events. Traceback (most recent call last): File "/opt/splunk/etc/apps/TA-MS-AAD/bin/ta_ms_aad/aob_py3/modinput_wrapper/base_modinput.py", line 128, in stream_events self.collect_events(ew) File "/opt/splunk/etc/apps/TA-MS-AAD/bin/azure_security_center_input.py", line 88, in collect_events input_module.collect_events(self, ew) File "/opt/splunk/etc/apps/TA-MS-AAD/bin/input_module_azure_security_center_input.py", line 83, in collect_events if (this_changedTime > max_asc_task_date): TypeError: '>' not supported between instances of 'str' and 'NoneType' Our app has "Reader" permissions in Azure which fixed a 403 error before we got to this point, and its very likely that this error is related to a permission setting somewhere in Azure (potentially similar to this solved question). This error is only happening for Security TASKs, though we are not getting any events for Security Alerts either when one is enabled and the other is disabled.

samejgink · ‎05-08-2020

So I happen to be working with the Zoom API and your link to the documentation helped me out, so I'll use their endpoint API as a reference. Per the documentation they suggest using the namespace, so the URL parameter should have the value ${settings.additional_parameters.param_name} I'm using JWT for authentication, and have created a Text property in Add-on Setup Paramaters with Global Account Settings checked. This parameter's Internal Name = jwt_token . Yes, adding "token" is redundant... I have also created another Data Input Parameter called Query URL, internal name = query_url So my REST URL looks like this: https://api.zoom.us/v2/${query_url}?access_token=${__settings__.additional_parameters.jwt_token}&page_size=300 In Data Input Parameters I add which API endpoint I will be targeting, in this particular case =users and on the Add-on Setup Parameters tab there will be an "Additional Parameters", and that is where I add my JWT. If you're having problems with the built in Username & Password, I'd suggest building your own parameters for those values. Hope this helps!

samejgink · ‎03-19-2020

I am troubleshooting an issue with an app and the searchoperatorKV error I am receiving is: Invalid key-value parser, ignoring it, transform_name='my_transform'. When investigating the transforms.conf file, the transform in question looks like this: # transforms.conf [my_transform] MV_ADD = True My question is are the boolean values true and false case sensitive within the .conf files?

Posts	4
Solutions	1
Karma Given	5
Karma Received	1
Member Since	‎02-05-2020

Online Status	Offline
Date Last Visited	‎04-27-2023 12:48 PM

MS Azure Add-on (TA-MS-AAD) "TypeError: '>' not su...

Are booleans in .conf files case sensitive?

Re: Splunk_TA_New_Relic Insight not ingesting data

MS Azure Add-on (TA-MS-AAD) "TypeError: '>' not su...

Re: Splunk Add-on Builder REST API - Passing Globa...

Are booleans in .conf files case sensitive?