URI and API token is also configured but somehow missed above while editing. ... View more

Hello, I released a new version of the Okta app yesterday that hopefully addresses the issues others were seeing. If you have a specific use case I'd like to hear more about it so we can make the app more useful to everyone! ... View more

Hello, We released a new version of the Okta app yesterday that addressed this issue (among others) -- hopefully this helps! ... View more

In reviewing the Splunk 6.1.3 release notes, under the Windows-Specific issues it states: If you create a scripted input and use a full pathname as part of the stanza name (for example, C:\Program Files\Splunk\bin\scripts\getdata.bat, Splunk Enterprise fails to run the script and logs the error Error: Incorrect path to script, even if the script is in the proper directory. To work around the problem, use $SPLUNK_HOME instead of the full pathname. (SPL-82411, SPL-82897) Following this example, I used 7-zip to open the gzipped tarball that is the install file for the splunk app and modified the inputs.conf file located at okta/defaults/inputs.conf Changed the two script lines (1 and 😎 from *[script://./bin/okta.py] * to *[script://$SPLUNK_HOME\etc\apps\okta\bin\okta.py] * and *[script://./bin/oktausr.py] * to *[script://$SPLUNK_HOME\etc\apps\okta\bin\oktausr.py] * respectively (those are the default directories). Used 7zip to add the okta directory to a tar archive, then gizipped it. Changing the extension from *.tar.gz to *.tgz allowed it to be installed into splunk using the "import from file" method. This change modified the commands under settings > data > data inputs > scrips from /./bin/okta.py to $SPLUNK_HOME\etc\apps\okta\bin\okta.py and successfully queried my Okta instance after enabling the python scripts, and the remaining steps in the splunk app for okta documentation. Hope this helps. ... View more

If you are running under windows, change the forward slashes to back slashes for the [script] ... View more

I downvoted this post because spam content. ... View more

Sorry, vorcast is a site, the sourcetype=vorcast* is a apache access and error log, they are defined in splunk as vorcast_access and vorcast_error so sourcetype=vorcast* shows all of that in a search, i see that it works. searches for access_combined etc also show results. The site in questions logs to its own log files. ... View more

Hi Nick, I would expect this to be somewhat of a normal distribution (I failed to mention the range struck me as odd as well). The logs on which Splunk chewed are for the webserver only -- meaning only HTML (and headers for redirects, 404s, etc) are being served. We use Amazon CloudFront to distribute static assets including images, video, scripts, and stylesheets. The CDN origin logs to a different file and I did not import the origin logfiles to avoid skewing the data. The one-week logfile contained more than 1.5m lines and is the very reason I've never tried to analyze this by hand 🙂 ... View more