Was a solution ever found for this because I'm getting the exact same issue. ... View more

Hi @pyro_wood, I have looked at the conf presentation a few times but I noticed it's slightly old now so I was looking for some slightly newer opinions. I know Azure has changed a lot in the last two years so I thought there could be some notable differences between then and now. The main one that springs to mind is Azure's introduction of managed data disks. Cheers, Robbie ... View more

Hi xpac, Thanks for trying to help but I don't think theres anything wrong with the log format. I think changing the logging settings on multiple domain controllers would be harder than just figuring out how to fix this timestamp issue.The TA deals with all field extractions fine, it's only failing on the timestamp. Thanks! ... View more

I'm not too sure about the specific roles you require but when I created my identity list in Splunk ES I followed the following steps: http://docs.splunk.com/Documentation/ES/5.0.0/Admin/Configurenewassetoridentitylist I was also ESS_admin when I done this so that role should be enough I would think. If this doesn't help you then any further info on your problem might help in trying to assist you. Cheers! ... View more

If you wanted to do this for the top 10 customers then you could just change the limit to 10 in the top command etc etc. ... View more

Although I did think the script looked okay at first because I was of the understanding that you don't typically use headers in get requests. ... View more

Yeah i see what you mean! I'm new to Python so it might take me a while to work out how but I'll attempt to add the authorisation headers in the same way the POST commands did. ... View more

Okay, done 🙂 ... View more

import urllib import httplib2 import time import re from time import localtime,strftime from xml.dom import minidom import json baseurl = 'splunkserver:8089' username = 'user' password = 'password' # Step 1: Get a session key servercontent = httplib2.Http(disable_ssl_certificate_validation=True).request(baseurl + '/services/auth/login', 'POST', headers={}, body=urllib.urlencode({'username':username, 'password':password}))[1] sessionkey = minidom.parseString(servercontent).getElementsByTagName('sessionKey')[0].childNodes[0].nodeValue print "====>sessionkey: %s <====" % sessionkey # Step 2: Create a search job searchquery = 'search index=notable | top limit=5 _time unique_id' searchjob = httplib2.Http(disable_ssl_certificate_validation=True).request(baseurl + '/services/search/jobs','POST', headers={'Authorization': 'Splunk %s' % sessionkey},body=urllib.urlencode({'search': searchquery}))[1] sid = minidom.parseString(searchjob).getElementsByTagName('sid')[0].childNodes[0].nodeValue print "====>sid: %s <====" % sid #Step 3: Get the search status httplib2.Http(disable_ssl_certificate_validation=True).add_credentials(username, password) servicessearchstatusstr = '/services/search/jobs/%s/' % sid isnotdone = True while isnotdone: searchstatus = httplib2.Http(disable_ssl_certificate_validation=True).request(baseurl + servicessearchstatusstr, 'GET')[1] isdonestatus = re.compile('isDone">(0|1)') isdonestatus = isdonestatus.search(searchstatus).groups()[0] if (isdonestatus == '1'): isnotdone = False print "====>search status: %s <====" % isdonestatus # Step 4: Get the search results services_search_results_str = '/services/search/jobs/%s/results?output_mode=json&count=0' % sid searchresults = httplib2.Http(disable_ssl_certificate_validation=True).request(baseurl + services_search_results_str, 'GET')[1] print "====>search result: [%s] <====" % searchresults ... View more

I've posted the full script in the answers. ... View more