Hello, I am looking for suggestions on how to troubleshoot the python script crashing. I have experienced my message trace logs stopping two times in the last seven days. To resolve the issue i have to restart Splunk. I would like to continue to use this app, but if it keeps crashing i will have to stop using it. No other apps are installed on the heavy forwarder. I have the debug logs turned on, but they are not showing why the script crashes. The last event before the script crashes is: 2018-11-28 19:19:29,696 DEBUG pid=9007 tid=MainThread file=connectionpool.py:_make_request:400 | https://reports.office365.com:443 "GET /ecp/reportingwebservice/reporting.svc/MessageTrace?$filter=StartDate%20eq%20datetime'2018-11-27T04%3A59%3A21.366728Z'%20and%20EndDate%20eq%20datetime'2018-11-27T05%3A29%3A21.366728Z'&$skiptoken=27999 HTTP/1.1" 200 None 2018-11-27 14:04:00,778 DEBUG pid=25448 tid=MainThread file=connectionpool.py:_make_request:400 | https://reports.office365.com:443 "GET /ecp/reportingwebservice/reporting.svc/MessageTrace?$filter=StartDate%20eq%20datetime'2018-11-27T01%3A29%3A21.591658Z'%20and%20EndDate%20eq%20datetime'2018-11-27T01%3A59%3A21.591658Z'&$skiptoken=75999 HTTP/1.1" 200 None 2018-11-25 10:05:20,410 DEBUG pid=21262 tid=MainThread file=connectionpool.py:_make_request:400 | https://reports.office365.com:443 "GET /ecp/reportingwebservice/reporting.svc/MessageTrace?$filter=StartDate%20eq%20datetime'2018-11-24T21%3A29%3A25.054247Z'%20and%20EndDate%20eq%20datetime'2018-11-24T21%3A59%3A25.054247Z'&$skiptoken=107999 HTTP/1.1" 200 None Splunk Enterprise version 6.6.7 App version 1.1.0 4 CPU 8 GB RAM 100 GB hard drive Thanks! ... View more

I have experienced this issue twice. The app will crash and get behind and not be able to catch up. I think o365 api only keeps a certain time frame of logs and then after that they are not accessible. Once the installation is querying the logs that are inaccessible, the app never catches backup to when logs are present. In the past the only solution was to reinstall the app. But the start and end date must be located in a kvstore or lookup somewhere. Has anyone figured out how to update those values without reinstalling the app? I have tried the web interface, but once the app gets started it doesn't seem to respect the start date inputted into the web configuration. Any help is appreciated. Using version 1.1.0 of the app Splunk enterprise version: 6.6.7 ... View more

I have installed the Microsoft Office 365 Reporting Add-on for Splunk version 1.0.1 on my Heavy Forwarder running Splunk Enterprise version 6.5.2. When I try to go to the Configuration Account page, the page never loads. The error I see in splunkd.log is 03-30-2018 16:35:32.979 +0000 ERROR AdminManagerExternal - Unexpected error "" from python handler: "REST Error [404]: Not Found -- HTTP 404 Not Found -- {"messages":[{"type":"ERROR","text":"Not Found"}]}". See splunkd.log for more details. 03-30-2018 16:35:32.979 +0000 ERROR AdminManagerExternal - Stack trace from python handler:\nTraceback (most recent call last):\n File "/opt/splunk/lib/python2.7/site-packages/splunk/admin.py", line 129, in init\n hand.execute(info)\n File "/opt/splunk/lib/python2.7/site-packages/splunk/admin.py", line 590, in execute\n if self.requestedAction == ACTION_LIST: self.handleList(confInfo)\n File "/opt/splunk/etc/apps/TA-MS_O365_Reporting/bin/ta_ms_o365_reporting/splunk_aoblib/rest_migration.py", line 38, in handleList\n AdminExternalHandler.handleList(self, confInfo)\n File "/opt/splunk/etc/apps/TA-MS_O365_Reporting/bin/ta_ms_o365_reporting/splunktaucclib/rest_handler/admin_external.py", line 40, in wrapper\n for entity in result:\n File "/opt/splunk/etc/apps/TA-MS_O365_Reporting/bin/ta_ms_o365_reporting/splunktaucclib/rest_handler/handler.py", line 118, in wrapper\n raise RestError(exc.status, exc.message)\nRestError: REST Error [404]: Not Found -- HTTP 404 Not Found -- {"messages":[{"type":"ERROR","text":"Not Found"}]}\n The app was pushed from a deployment server with the name TA-MS_O365_Reporting. ... View more

We have a Splunk ES user who has left and now their correlation searches are orphaned. I am aware of the feature to clone a saved search, but wasn't sure if Splunk ES needed additional steps to ensure the notable and other ES data would be retained with the clone. I tried to clone the correlation search, but this only created a new saved search and not a true correlation search with notable information. ... View more

I am successfully seeing Nessus data in Splunk, but all the data is going into the main index. I would like to put the data in a different index. Is this possible? Thanks. ... View more

The openVPN log extract for TA-pfsense version 1.1 was not working for my pfsense 2.1.5 which runs openvpn 2.3.3. The src ip and usernames are not being extracted properly. ... View more

I am attempting to map Microsoft TMG logs to CEF with the Splunk app for CEF and I am not able to map the requestURL field. It is not an option in the dropdown box. How can I add this field? Is it a text file within the app? ... View more