×

Join the Conversation

Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
travis_lelle
Explorer
Member since: ‎11-03-2017
4 weeks ago
Community Statistics
Posts 7
Solutions 0
Karma Given 0
Karma Received 6
Member Since ‎11-03-2017
Activity Feed
View All

Re: Why aren't Risk Score, Risk Event and Risk Obj...

by in Splunk Enterprise Security
‎09-22-2023 08:11 AM
‎09-22-2023 08:11 AM
Have you found a solution for this? I'm experiencing the same thing, and I made sure that the fields we provided in the Risk Analysis Adaptive response Action is a valid field that is being presented in the correlation search results. In fact, I'm using the same fields as variables in the title of the notable event. But nothing is populating in Incident review for Risk Score, Risk Event, and Risk Object. ... View more

Re: Issue setting up Microsoft OMS Modular Inputs ...

by in Getting Data In
‎03-07-2018 11:35 AM
‎03-07-2018 11:35 AM
Looks like I'm still receiving the following error: 03-07-2018 19:32:48.346 +0000 ERROR ExecProcessor - message from "python /opt/app/splunk/etc/apps/TA-OMS_Inputs/bin/oms_inputs.py" ERRORGet Token request returned http error: 400 and server response: {"error":"unauthorized_client","error_description":"AADSTS70001: Application with identifier '*' was not found in the directory a74cd446-d03c-4d05-afea-429e248a5fc4\r\nTrace ID: b8f81f70-b64b-42ad-b497-8237e9e71000\r\nCorrelation ID: f3d3d29d-cb52-4a91-8cb8-fbabdfc75cfb\r\nTimestamp: 2018-03-07 19:32:48Z","error_codes":[70001],"timestamp":"2018-03-07 19:32:48Z","trace_id":"b8f81f70-b64b-42ad-b497-8237e9e71000","correlation_id":"f3d3d29d-cb52-4a91-8cb8-fbabdfc75cfb"} ... View more

Re: Issue setting up Microsoft OMS Modular Inputs ...

by in Getting Data In
‎03-02-2018 07:46 AM
‎03-02-2018 07:46 AM
It looks like we're getting closer. The new error I'm getting is: 03-02-2018 15:41:20.649 +0000 ERROR ExecProcessor - message from "python /opt/app/splunk/etc/apps/TA-OMS_Inputs/bin/oms_inputs.py" ERRORGet Token request returned http error: 400 and server response: {"error":"unauthorized_client","error_description":"AADSTS70001: Application with identifier '*' was not found in the directory a74cd446-d03c-4d05-afea-429e248a5fc4\r\nTrace ID: e68d1ee2-afbd-4e6c-b520-8fa55f020a00\r\nCorrelation ID: 84105cb3-2af7-4d39-9833-5090338c8a08\r\nTimestamp: 2018-03-02 15:41:20Z","error_codes":[70001],"timestamp":"2018-03-02 15:41:20Z","trace_id":"e68d1ee2-afbd-4e6c-b520-8fa55f020a00","correlation_id":"84105cb3-2af7-4d39-9833-5090338c8a08"} I think the reason may be because of asterisks in the Resource Group, Application ID, and Application Key. Can you provide some guidance on what might typically go into these fields. Pardon my lack of knowledge with OMS, I'm just trying to get the data into Splunk for another party. ... View more

Issue setting up Microsoft OMS Modular Inputs TA

by in Getting Data In
‎01-24-2018 07:09 AM
1 Karma
‎01-24-2018 07:09 AM
1 Karma
I'm trying to setup the TA, and have filled out all of the required fields (information taken from an azure subscription), and we aren't pulling data, but are seeing the following error messages occur 01-24-2018 14:58:48.386 +0000 ERROR ExecProcessor - message from "python /opt/app/splunk/etc/apps/TA-OMS_Inputs/bin/oms_inputs.py" ERRORacquire_token_with_client_credentials() takes exactly 4 arguments (5 given) 2018-01-24 15:00:00,624 ERROR pid=115140 tid=MainThread file=configuration_check.py:run:164 | status="completed" task="confcheck_script_errors" message="msg="A script exited abnormally" input="/opt/app/splunk/etc/apps/TA-OMS_Inputs/bin/oms_inputs.py" stanza="oms_inputs://oms_splunk" status="exited with code 1"" Any help would be appreciated. @jkat54 ... View more

Re: Microsoft Cloud services Addon stops collectin...

by in All Apps and Add-ons
‎11-29-2017 08:23 AM
‎11-29-2017 08:23 AM
Splunk support should be able to provide you with the "experimental" version, which is a fixed version that pretty much takes care of the issue. ... View more

Re: Microsoft Cloud services Addon stops collectin...

by in All Apps and Add-ons
‎11-14-2017 07:59 AM
‎11-14-2017 07:59 AM
Nothing. I have a support ticket open with Splunk. ... View more

Microsoft Cloud services Addon stops collecting lo...

by in All Apps and Add-ons
‎11-03-2017 08:16 AM
5 Karma
‎11-03-2017 08:16 AM
5 Karma
I've experienced the same issue in multiple environments. We're running Splunk Enterprise 6.6.3 and the Microsoft Cloud Services addon. Logs will pull for maybe a day or two, and then we begin to see the following errors in splunk_ta_microsoft-cloudservices_management.log. Typically a reboot will fix the issue, but not all the time. File "/opt/splunk/etc/apps/Splunk_TA_microsoft-cloudservices/bin/splunktamscs/o365_content.py", line 240, in get_events self.do_get_events(content_dict) File "/opt/splunk/etc/apps/Splunk_TA_microsoft-cloudservices/bin/splunktamscs/o365_content.py", line 256, in do_get_events events = self.get_one_content(content_dict) File "/opt/splunk/etc/apps/Splunk_TA_microsoft-cloudservices/bin/splunktamscs/o365_content.py", line 154, in get_one_content return self._content_request(url=content_info[c.content_uri]) File "/opt/splunk/etc/apps/Splunk_TA_microsoft-cloudservices/bin/splunktamscs/o365_content.py", line 124, in _content_request raise ome.O365GetContentError(msg + http_resp.msg) O365GetContentError: Account d3dbea26-263d-4578-bfe4-f300326a3a11_o365 [proxy_type="http" proxy_rdns="0" proxy_enabled="0" ] GET request to https://manage.office.com/api/v1.0/cc03cb3f-e51d-4fb2-b5f4-d7106 1153612/activity/feed/audit/20171031061141455019716$20171031061141455019716$audit_sharepoint$Audit_SharePoint failed, reason: 403, {"error":{"code":"AF429","message":"Too many requests. Method=GetBlob, Pu blisherId=00000000-0000-0000-0000-000000000000"}} 2017-11-03 14:59:27,968 +0000 log_level=INFO, pid=29666, tid=Thread-70, file=o365_helper.py, func_name=request, code_line_no=102 | [proxy_type="http" proxy_rdns="0" proxy_enabled="0" ] Sending GET request to https://manage.office.com/api/v1.0/cc03cb3f-e51d-4fb2-b5f4-d71061153612/activity/feed/audit/20171031061205608021143$20171031061205608021143$audit_sharepoint$Audit_SharePoint 2017-11-03 14:59:27,991 +0000 log_level=INFO, pid=29666, tid=Thread-6, file=o365_content.py, func_name=tear_down, code_line_no=338 | [input_name="d3dbea26-263d-4578-bfe4-f300326a3a11_o365_Audit.SharePoint " account="d3dbea26-263d-4578-bfe4-f300326a3a11_o365" data="Audit.SharePoint" proxy_type="http" proxy_rdns="0" proxy_enabled="0" ]Start to tear down, wait=False 2017-11-03 14:59:27,991 +0000 log_level=INFO, pid=29666, tid=Thread-6, file=o365_content.py, func_name=tear_down, code_line_no=341 | [input_name="d3dbea26-263d-4578-bfe4-f300326a3a11_o365_Audit.SharePoint " account="d3dbea26-263d-4578-bfe4-f300326a3a11_o365" data="Audit.SharePoint" proxy_type="http" proxy_rdns="0" proxy_enabled="0" ]Finish to tear down, wait=False 2017-11-03 14:59:27,991 +0000 log_level=ERROR, pid=29666, tid=Thread-6, file=o365_data_collector.py, func_name=_do_safe_index, code_line_no=176 | [input_name="d3dbea26-263d-4578-bfe4-f300326a3a11_o365_Aud it.SharePoint" account="d3dbea26-263d-4578-bfe4-f300326a3a11_o365" data="Audit.SharePoint"]Failed to get msg from servers=hf1.company.gpsvsoc.com, metric=Audit.SharePoint, error=Traceback (most recent call last): O365GetContentError: [input_name="d3dbea26-263d-4578-bfe4-f300326a3a11_o365_Audit.SharePoint" account="d3dbea26-263d-4578-bfe4-f300326a3a11_o365" data="Audit.SharePoint" proxy_type="http" proxy_rdns="0" p roxy_enabled="0" ]Fail to get events of content 20171031061141455019716$20171031061141455019716$audit_sharepoint$Audit_SharePoint, stop this round ... View more
Contact Me
Online Status
Offline
Date Last Visited
4 weeks ago
Karma from