Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About nmadhok
nmadhok
Path Finder
Member since:
08-30-2017
09-22-2021
Community Statistics
| Posts | 12 |
| Solutions | 2 |
| Karma Given | 2 |
| Karma Received | 21 |
| Member Since | 08-30-2017 |
Activity Feed
- Got Karma for Re: Posting data to HTTP Event Collector (HEC) without passing HEC Token in Authorization Header. 02-08-2022 06:49 AM
- Got Karma for Re: Posting data to HTTP Event Collector (HEC) without passing HEC Token in Authorization Header. 06-24-2020 05:39 PM
- Got Karma for Re: Posting data to HTTP Event Collector (HEC) without passing HEC Token in Authorization Header. 06-23-2020 01:54 PM
- Got Karma for Re: Posting data to HTTP Event Collector (HEC) without passing HEC Token in Authorization Header. 06-16-2020 02:14 AM
- Tagged Posting data to HTTP Event Collector (HEC) without passing HEC Token in Authorization Header on Getting Data In. 06-16-2020 12:09 AM
- Tagged Re: Posting data to HTTP Event Collector (HEC) without passing HEC Token in Authorization Header on Getting Data In. 06-16-2020 12:08 AM
- Tagged Posting data to HTTP Event Collector (HEC) without passing HEC Token in Authorization Header on Getting Data In. 06-16-2020 12:08 AM
- Tagged Re: Posting data to HTTP Event Collector (HEC) without passing HEC Token in Authorization Header on Getting Data In. 06-16-2020 12:08 AM
- Tagged Re: Posting data to HTTP Event Collector (HEC) without passing HEC Token in Authorization Header on Getting Data In. 06-16-2020 12:07 AM
- Tagged Re: Posting data to HTTP Event Collector (HEC) without passing HEC Token in Authorization Header on Getting Data In. 06-16-2020 12:07 AM
- Tagged Re: Posting data to HTTP Event Collector (HEC) without passing HEC Token in Authorization Header on Getting Data In. 06-16-2020 12:07 AM
- Posted Re: Posting data to HTTP Event Collector (HEC) without passing HEC Token in Authorization Header on Getting Data In. 06-15-2020 11:48 PM
- Posted Posting data to HTTP Event Collector (HEC) without passing HEC Token in Authorization Header on Getting Data In. 06-15-2020 11:19 PM
- Tagged Posting data to HTTP Event Collector (HEC) without passing HEC Token in Authorization Header on Getting Data In. 06-15-2020 11:19 PM
- Tagged Posting data to HTTP Event Collector (HEC) without passing HEC Token in Authorization Header on Getting Data In. 06-15-2020 11:19 PM
- Karma Installation/Update of Splunk 7.2.4 on SLES 12 failes due to dependency for DMohn. 06-05-2020 12:50 AM
- Got Karma for Microsoft Office 365 Reporting Add-on for Splunk not pulling data - exiting with 500 Internal Server Error. 06-05-2020 12:50 AM
- Got Karma for Re: Microsoft Office 365 Reporting Add-on for Splunk not pulling data - exiting with 500 Internal Server Error. 06-05-2020 12:50 AM
- Got Karma for Microsoft Office 365 Reporting Add-on for Splunk not pulling data - exiting with 500 Internal Server Error. 06-05-2020 12:50 AM
- Got Karma for Microsoft Office 365 Reporting Add-on for Splunk not pulling data - exiting with 500 Internal Server Error. 06-05-2020 12:50 AM
Topics I've Started
06-15-2020
11:48 PM
4 Karma
Query string authentication can be enabled on a per-token basis. On the Splunk server, edit the file at $SPLUNK_HOME/etc/apps/splunk_httpinput/local/inputs.conf . Tokens are listed by name in this file, in the form http://<token_name> . Within the stanza for each token that needs to enable query string authentication, add the following setting (or change the existing setting, if applicable): allowQueryStringAuth = true Save and close the inputs.conf file and restart Splunk service to reload configuration. For Splunk Cloud, you must open a Splunk Support ticket to set allowQueryStringAuth to true. Support for a toggle in Splunk Web for this setting is planned for a future release. HEC token can then be specified as a query string in the URL in the format: ?token=<hec_token> For example: curl -k "https://my-splunk-hec.example.com:8088/services/collector/raw?token=91dfd4e5-da4f-4861-89dd-dcdec19067fb&channel=8cf7407d-fa98-4d97-9b7b-5f5902aa7744&sourcetype=mydata" -d '1, 2, 3... Hello, world!'
... View more
06-15-2020
11:19 PM
Wanting to forward all raw events from Client/Application to a specified HTTP Event Collector (HEC) endpoint/URL for on-prem/self-hosted Splunk environment but Client/Application only allows for a URL to be specified and does not allow specifying the HEC token in authorization header for HTTP Authentication or including it in basic authentication request. How can the raw events be ingested into on-prem/self hosted Splunk using HTTP Event Collector (HEC) input without an Authorization header? Is it possible to specify the HEC token as a query string/parameter in the URL itself?
... View more
Labels
- Labels:
-
HTTP Event Collector
05-21-2020
08:15 PM
Because you have misspelt the endpoint in the URL ( serivces/collector ) instead of ( services/collector )
This is what you have:
https://prd-p-2lsvqbxyzzzzz.cloud.splunk.com:8088/serivces/collector
This is what it should be:
https://prd-p-2lsvqbxyzzzzz.cloud.splunk.com:8088/services/collector
... View more
12-05-2019
05:23 AM
1 Karma
We opened a case with Microsoft on 10/31 and the case was resolved by 11/02 after which we were no longer getting 500 Internal Server Error and the Add-On was pulling data once again. Here's the Preliminary Post Incident Review Report from Microsoft related to this incident.
... View more
10-31-2019
11:53 AM
@jonesy1111 Not a problem. Don't think it's an issue with the url format since if you directly hit the API endpoint, it shows the error. Please upvote the question to keep a count of people affected by this issue
... View more
10-31-2019
11:51 AM
@raugugliaro_ao Let us know if you hear back from Microsoft Support. Also upvote the question to keep a count of people affected by this issue
... View more
10-31-2019
11:39 AM
@tommusgrave Let us know if you hear back from Microsoft Support. Also upvote the question to keep a count of people affected by this issue
... View more
10-31-2019
09:25 AM
@jonesy1111 The document referenced above says that the MessageTrace method will continue to work as expected and is not impacted by this deprecation
https://docs.microsoft.com/en-us/previous-versions/office/developer/o365-enterprise-developers/jj984335(v=office.15)
... View more
10-31-2019
09:03 AM
@jconger I did that and got the following error:
<m:error xmlns:m="http://schemas.microsoft.com/ado/2007/08/dataservices/metadata">
<m:code/>
<m:message xml:lang="en-US">An error occurred while processing this request.</m:message>
</m:error>
... View more
10-31-2019
06:55 AM
@jconger @lnetto_splunk
... View more
10-31-2019
06:48 AM
11 Karma
Installed and configured Microsoft Office 365 Reporting Add-on for Splunk but it doesn't seem to be pulling any data. Here's the error we see in the ta_ms_o365_reporting_ms_o365_message_trace.log file:
2019-10-30 16:21:16,836 INFO pid=40891 tid=MainThread file=connectionpool.py:_new_conn:758 | Starting new HTTPS connection (1): 127.0.0.1
2019-10-30 16:21:17,674 INFO pid=40891 tid=MainThread file=connectionpool.py:_new_conn:758 | Starting new HTTPS connection (1): 127.0.0.1
2019-10-30 16:21:19,141 INFO pid=40891 tid=MainThread file=connectionpool.py:_new_conn:758 | Starting new HTTPS connection (1): 127.0.0.1
2019-10-30 16:21:20,569 INFO pid=40891 tid=MainThread file=splunk_rest_client.py:_request_handler:100 | Use HTTP connection pooling
2019-10-30 16:21:20,570 DEBUG pid=40891 tid=MainThread file=binding.py:get:664 | GET request to https://127.0.0.1:8089/servicesNS/nobody/TA-MS_O365_Reporting/storage/collections/config/TA_MS_O365_Reporting_checkpointer (body: {})
2019-10-30 16:21:20,571 INFO pid=40891 tid=MainThread file=connectionpool.py:_new_conn:758 | Starting new HTTPS connection (1): 127.0.0.1
2019-10-30 16:21:20,576 DEBUG pid=40891 tid=MainThread file=connectionpool.py:_make_request:387 | "GET /servicesNS/nobody/TA-MS_O365_Reporting/storage/collections/config/TA_MS_O365_Reporting_checkpointer HTTP/1.1" 200 5516
2019-10-30 16:21:20,577 DEBUG pid=40891 tid=MainThread file=binding.py:new_f:71 | Operation took 0:00:00.006580
2019-10-30 16:21:20,577 DEBUG pid=40891 tid=MainThread file=binding.py:get:664 | GET request to https://127.0.0.1:8089/servicesNS/nobody/TA-MS_O365_Reporting/storage/collections/config/ (body: {'count': -1, 'search': 'TA_MS_O365_Reporting_checkpointer', 'offset': 0})
2019-10-30 16:21:20,580 DEBUG pid=40891 tid=MainThread file=connectionpool.py:_make_request:387 | "GET /servicesNS/nobody/TA-MS_O365_Reporting/storage/collections/config/?count=-1&search=TA_MS_O365_Reporting_checkpointer&offset=0 HTTP/1.1" 200 7417
2019-10-30 16:21:20,580 DEBUG pid=40891 tid=MainThread file=binding.py:new_f:71 | Operation took 0:00:00.003192
2019-10-30 16:21:20,583 DEBUG pid=40891 tid=MainThread file=binding.py:get:664 | GET request to https://127.0.0.1:8089/servicesNS/nobody/TA-MS_O365_Reporting/storage/collections/data/TA_MS_O365_Reporting_checkpointer/o365_message_trace_obj_checkpoint (body: {})
2019-10-30 16:21:20,585 DEBUG pid=40891 tid=MainThread file=connectionpool.py:_make_request:387 | "GET /servicesNS/nobody/TA-MS_O365_Reporting/storage/collections/data/TA_MS_O365_Reporting_checkpointer/o365_message_trace_obj_checkpoint HTTP/1.1" 404 140
2019-10-30 16:21:20,587 DEBUG pid=40891 tid=MainThread file=base_modinput.py:log_debug:286 | Start date: 2019-09-10 00:00:00, End date: 2019-09-10 01:00:00
2019-10-30 16:21:20,587 DEBUG pid=40891 tid=MainThread file=base_modinput.py:log_debug:286 | Endpoint URL: https://reports.office365.com/ecp/reportingwebservice/reporting.svc/MessageTrace?$filter=StartDate eq datetime'2019-09-10T00:00:00Z' and EndDate eq datetime'2019-09-10T01:00:00Z'
2019-10-30 16:21:20,587 INFO pid=40891 tid=MainThread file=setup_util.py:log_info:114 | Proxy is not enabled!
2019-10-30 16:21:20,596 DEBUG pid=40891 tid=MainThread file=connectionpool.py:_new_conn:809 | Starting new HTTPS connection (1): reports.office365.com
2019-10-30 16:21:20,976 DEBUG pid=40891 tid=MainThread file=connectionpool.py:_make_request:400 | https://reports.office365.com:443 "GET /ecp/reportingwebservice/reporting.svc/MessageTrace?$filter=StartDate%20eq%20datetime'2019-09-10T00:00:00Z'%20and%20EndDate%20eq%20datetime'2019-09-10T01:00:00Z' HTTP/1.1" 500 113
2019-10-30 16:21:20,979 ERROR pid=40891 tid=MainThread file=base_modinput.py:log_error:307 | HTTP Request error: 500 Server Error: Internal Server Error for url: https://reports.office365.com/ecp/reportingwebservice/reporting.svc/MessageTrace?$filter=StartDate%20eq%20datetime'2019-09-10T00:00:00Z'%20and%20EndDate%20eq%20datetime'2019-09-10T01:00:00Z'
... View more
03-24-2018
02:08 PM
4 Karma
Hello,
Please remove sslVersion=tls1.1,tls1.2 from [default] section of your inputs.conf file and instead put it under [SSL] section of your inputs.conf file followed by a Splunk service restart.
inputs.conf:
[SSL]
sslVersion=tls1.1,tls1.2
The issue exists because when you put sslVersion under [default] stanza of your inputs.conf file, it gets copied into each HTTP Event Collector Token stanza ( http://<INPUT-NAME>; ). This should not be happening and is most likely a bug. When specifying sslVersion under [default] stanza of your inputs.conf , the intended/desired behavior should be the same as when specifying sslVersion under the [http] stanza of your inputs.conf file.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
09-22-2021
02:37 AM
|
Karma from
