Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About matthewroberson
matthewroberson
Path Finder
Member since:
10-02-2014
01-02-2025
Community Statistics
| Posts | 30 |
| Solutions | 2 |
| Karma Given | 4 |
| Karma Received | 5 |
| Member Since | 10-02-2014 |
Activity Feed
- Posted Re: Splunk Enterprise Security 8.0.1 download link on Splunk Enterprise Security. 12-16-2024 08:40 PM
- Karma Re: Splunk Enterprise Security 8.0.1 download link for SanjayReddy. 12-16-2024 08:40 PM
- Got Karma for Splunk Enterprise Security 8.0.1 download link. 12-12-2024 03:43 PM
- Posted Splunk Enterprise Security 8.0.1 download link on Splunk Enterprise Security. 12-12-2024 02:37 PM
- Tagged Splunk Enterprise Security 8.0.1 download link on Splunk Enterprise Security. 12-12-2024 02:37 PM
- Tagged Splunk Enterprise Security 8.0.1 download link on Splunk Enterprise Security. 12-12-2024 02:37 PM
- Posted Re: Splunk Add on for Microsoft Azure 404 Client Error: Not Found for url- How would I fix? on All Apps and Add-ons. 09-27-2022 10:13 AM
- Tagged Splunk Add on for Microsoft Azure 404 Client Error: Not Found for url- How would I fix? on All Apps and Add-ons. 09-14-2022 10:47 PM
- Posted Splunk Add on for Microsoft Azure 404 Client Error: Not Found for url- How would I fix? on All Apps and Add-ons. 09-14-2022 12:07 PM
- Tagged Splunk Add on for Microsoft Azure 404 Client Error: Not Found for url- How would I fix? on All Apps and Add-ons. 09-14-2022 12:07 PM
- Tagged Splunk Add on for Microsoft Azure 404 Client Error: Not Found for url- How would I fix? on All Apps and Add-ons. 09-14-2022 12:07 PM
- Tagged Splunk Add on for Microsoft Azure 404 Client Error: Not Found for url- How would I fix? on All Apps and Add-ons. 09-14-2022 12:07 PM
- Posted Re: Microsoft Azure Add-on for Splunk version config problem on All Apps and Add-ons. 10-19-2021 12:21 PM
- Karma Re: Microsoft Azure Add-on for Splunk version config problem for gordo32. 10-19-2021 12:19 PM
- Karma Re: Palo Alto Networks Add-on: How to stop "minemeld" lookup errors? for panguy. 09-28-2021 06:50 AM
- Posted Re: Why does Splunk universal forwarder have high CPU usage on system? on Getting Data In. 09-23-2021 06:17 PM
- Posted Re: Users can't send mail after upgrade to 8.0.5 on Splunk Enterprise. 07-02-2021 09:49 AM
- Posted Re: Microsoft Azure Add-on for Splunk version config problem on All Apps and Add-ons. 10-06-2020 07:51 PM
- Posted Re: Palo Alto Networks Add-on error with rest_migration.py on All Apps and Add-ons. 09-03-2020 03:04 PM
- Posted Re: Palo Alto Networks Add-on error with rest_migration.py on All Apps and Add-ons. 09-03-2020 12:46 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 |
12-16-2024
08:40 PM
Will the patched version of the MLTK work with ES 7.3.2? https://advisory.splunk.com/advisories/SVD-2024-1102
... View more
12-12-2024
02:37 PM
1 Karma
The documentation seems to suggest that version 8.0.1 of "Splunk Enterprise Security" is available for download from splunkbase, however the lastest version available there appears to be 7.3.2. Am I missing something? https://docs.splunk.com/Documentation/ES/8.0.1/Install/UpgradetoNewVersion https://splunkbase.splunk.com/app/263/
... View more
Labels
- Labels:
-
upgrade
09-27-2022
10:13 AM
I'm creating inputs through the GUI. And it turned out to be an input for the commercial tenant ( not the government tenant ) that was throwing the error. Should the signin input for the government tenant work if we haven't created a subscription yet in the government tenant? We have a python script that is able to connect and pull back signins, but the input we created in the app isn't working. To help with troubleshooting, I disabled all the inputs except the signins input for the government tenant. What I see in the logs every time the input is scheduled to check is: 2022-09-27 12:08:11,617 DEBUG pid=31970 tid=MainThread file=connectionpool.py:_make_request:465 | https://127.0.0.1:8089 "GET /servicesNS/nobody/TA-MS-AAD/storage/collections/data/TA_MS_AAD_checkpointer/aad_signin_last_date_ADSignins_SPP_GCC HTTP/1.1" 404 140
127.0.0.1 - splunk-system-user [27/Sep/2022:12:08:11.615 -0500] "GET /servicesNS/nobody/TA-MS-AAD/storage/collections/data/TA_MS_AAD_checkpointer/aad_signin_last_date_ADSignins_SPP_GCC HTTP/1.1" 404 140 "-" "curl" - - - 1ms
2022-09-27 12:08:11,614 DEBUG pid=31970 tid=MainThread file=binding.py:get:695 | GET request to https://127.0.0.1:8089/servicesNS/nobody/TA-MS-AAD/storage/collections/data/TA_MS_AAD_checkpointer/aad_signin_last_date_ADSignins_SPP_GCC (body: {})
2022-09-27 12:08:11,613 DEBUG pid=31970 tid=MainThread file=connectionpool.py:_make_request:465 | https://127.0.0.1:8089 "GET /servicesNS/nobody/TA-MS-AAD/storage/collections/config/?count=-1&offset=0&search=TA_MS_AAD_checkpointer HTTP/1.1" 200 4505
127.0.0.1 - splunk-system-user [27/Sep/2022:12:08:11.611 -0500] "GET /servicesNS/nobody/TA-MS-AAD/storage/collections/config/?count=-1&offset=0&search=TA_MS_AAD_checkpointer HTTP/1.1" 200 4505 "-" "curl" - - - 1ms
2022-09-27 12:08:11,610 DEBUG pid=31970 tid=MainThread file=binding.py:get:695 | GET request to https://127.0.0.1:8089/servicesNS/nobody/TA-MS-AAD/storage/collections/config/ (body: {'count': -1, 'offset': 0, 'search': 'TA_MS_AAD_checkpointer'})
2022-09-27 12:08:11,609 DEBUG pid=31970 tid=MainThread file=connectionpool.py:_make_request:465 | https://127.0.0.1:8089 "GET /servicesNS/nobody/TA-MS-AAD/storage/collections/config/TA_MS_AAD_checkpointer HTTP/1.1" 200 5353
127.0.0.1 - splunk-system-user [27/Sep/2022:12:08:11.608 -0500] "GET /servicesNS/nobody/TA-MS-AAD/storage/collections/config/TA_MS_AAD_checkpointer HTTP/1.1" 200 5353 "-" "curl" - - - 1ms
2022-09-27 12:08:11,598 DEBUG pid=31970 tid=MainThread file=binding.py:get:695 | GET request to https://127.0.0.1:8089/servicesNS/nobody/TA-MS-AAD/storage/collections/config/TA_MS_AAD_checkpointer (body: {})
127.0.0.1 - splunk-system-user [27/Sep/2022:12:08:11.587 -0500] "GET /servicesNS/nobody/TA-MS-AAD/configs/conf-ta_ms_aad_settings/logging?output_mode=json HTTP/1.1" 200 1534 "-" "curl" - - - 1ms
127.0.0.1 - splunk-system-user [27/Sep/2022:12:08:11.553 -0500] "GET /servicesNS/nobody/TA-MS-AAD/configs/conf-ta_ms_aad_settings/_reload HTTP/1.1" 200 2025 "-" "curl" - - - 22ms
127.0.0.1 - splunk-system-user [27/Sep/2022:12:08:11.539 -0500] "GET /servicesNS/nobody/TA-MS-AAD/TA_MS_AAD_settings/logging?output_mode=json&count=0&--cred--=1 HTTP/1.1" 200 1071 "-" "curl" - - - 55ms
127.0.0.1 - splunk-system-user [27/Sep/2022:12:08:11.517 -0500] "GET /servicesNS/nobody/TA-MS-AAD/storage/passwords?count=-1&offset=0 HTTP/1.1" 200 41679 "-" "curl" - - - 2ms
127.0.0.1 - splunk-system-user [27/Sep/2022:12:08:11.504 -0500] "GET /servicesNS/nobody/TA-MS-AAD/configs/conf-ta_ms_aad_settings/proxy?output_mode=json HTTP/1.1" 200 1501 "-" "curl" - - - 1ms
127.0.0.1 - splunk-system-user [27/Sep/2022:12:08:11.470 -0500] "GET /servicesNS/nobody/TA-MS-AAD/configs/conf-ta_ms_aad_settings/_reload HTTP/1.1" 200 2025 "-" "curl" - - - 23ms
127.0.0.1 - splunk-system-user [27/Sep/2022:12:08:11.457 -0500] "GET /servicesNS/nobody/TA-MS-AAD/TA_MS_AAD_settings/proxy?output_mode=json&count=0&--cred--=1 HTTP/1.1" 200 1106 "-" "curl" - - - 70ms
127.0.0.1 - splunk-system-user [27/Sep/2022:12:08:11.404 -0500] "GET /servicesNS/nobody/TA-MS-AAD/data/inputs/MS_AAD_signins?output_mode=json&count=0 HTTP/1.1" 200 4606 "-" "curl" - - - 33ms
127.0.0.1 - splunk-system-user [27/Sep/2022:12:08:11.391 -0500] "GET /servicesNS/nobody/TA-MS-AAD/TA_MS_AAD_MS_AAD_signins?output_mode=json&count=0&--cred--=1 HTTP/1.1" 200 3872 "-" "curl" - - - 50ms
127.0.0.1 - splunk-system-user [27/Sep/2022:12:08:11.369 -0500] "GET /servicesNS/nobody/TA-MS-AAD/storage/passwords?count=-1&offset=0 HTTP/1.1" 200 41679 "-" "curl" - - - 2ms
127.0.0.1 - splunk-system-user [27/Sep/2022:12:08:11.356 -0500] "GET /servicesNS/nobody/TA-MS-AAD/configs/conf-ta_ms_aad_account?output_mode=json&count=0 HTTP/1.1" 200 4096 "-" "curl" - - - 1ms
127.0.0.1 - splunk-system-user [27/Sep/2022:12:08:11.323 -0500] "GET /servicesNS/nobody/TA-MS-AAD/configs/conf-ta_ms_aad_account/_reload HTTP/1.1" 200 2020 "-" "curl" - - - 21ms
127.0.0.1 - splunk-system-user [27/Sep/2022:12:08:11.310 -0500] "GET /servicesNS/nobody/TA-MS-AAD/TA_MS_AAD_account?output_mode=json&count=0&--cred--=1 HTTP/1.1" 200 3028 "-" "curl" - - - 68ms
... View more
09-14-2022
12:07 PM
I am trying to configure the Splunk Add on for Microsoft Azure (version 4.0.2 on a stand alone Heavy Forwarder running version 9.0.1 of splunk, os RHEL 7) and I'm seeing the error below in /opt/splunk/var/log/splunk/ta_ms_aad_MS_AAD_audit.log. 2022-09-14 11:41:41,871 ERROR pid=12784 tid=MainThread file=base_modinput.py:log_error:316 | Get error when collecting events.
Traceback (most recent call last):
File "/opt/splunk/etc/apps/TA-MS-AAD/lib/splunktaucclib/modinput_wrapper/base_modinput.py", line 140, in stream_events
self.collect_events(ew)
File "/opt/splunk/etc/apps/TA-MS-AAD/bin/MS_AAD_audit.py", line 168, in collect_events
response = azutils.get_items_batch_session(helper=helper, url=url, session=session)
File "/opt/splunk/etc/apps/TA-MS-AAD/bin/ta_azure_utils/utils.py", line 119, in get_items_batch_session
raise e
File "/opt/splunk/etc/apps/TA-MS-AAD/bin/ta_azure_utils/utils.py", line 115, in get_items_batch_session
r.raise_for_status()
File "/opt/splunk/etc/apps/TA-MS-AAD/lib/requests/models.py", line 1021, in raise_for_status
raise HTTPError(http_error_msg, response=self)
requests.exceptions.HTTPError: 404 Client Error: Not Found for url: https://graph.microsoft.com/None/auditLogs/directoryAudits?$orderby=activityDateTime&$filter=activityDateTime+gt+2021-10-01T14:26:12.017133Z+and+activityDateTime+le+2022-09-14T16:34:41.623739Z On the Azure (Government) side we have the permissions below enabled: AuditLog.Read.All Device.Read.All Directory.Read.All Group.Read.All GroupMember.ReadWrite.All IdentityRiskEvent.Read.All Policy.Read.All Policy.Read.ConditionalAccess Policy.ReadWrite.ConditionalAccess SecurityEvents.Read.All User.Read User.Read.All Also, we have a P2 license so that should not be the issue. We have a python script that is able to retrieve signins from Azure using the same credentials we are using for the Splunk Add on for Microsoft Azure. Another thing I noticed is the url in the error message seem wrong. Seems like it should be: https://graph.microsoft.com/v1.0/auditLogs/directoryAudits$orderby=activityDateTime&$filter=activityDateTime+gt+2021-10-01T14:26:12.017133Z+and+activityDateTime+le+2022-09-14T16:34:41.623739Z A couple of other tidbits. The app works for our commercial tenant. Our government tenant is new and at this point doesn't have any subscriptions. Does anyone know if having more than zero subscriptions is a requirement for this app?
... View more
Labels
- Labels:
-
configuration
10-19-2021
12:21 PM
For us, it turned out to be a license issue. I have no idea why this isn't the first thing Microsoft support checked. Once we upgraded our license we were able to pull back sign-in logs.
... View more
09-23-2021
06:17 PM
tkoster8 - did you find a solution? I'm seeing the same issue on a server in my environment. jessec_splunk - The documentation you referenced says "For universal forwarders, a single pipeline set uses, on average, around 0.5 of a core, but utilization can reach a maximum of 1.5 cores. Therefore, two pipeline sets will use between 1.0 and 3.0 cores. If you want to configure more than two pipeline sets on a universal forwarder, consult with Professional Services first.” Would adding an additional pipeline for the UF reduce CPU utilization?
... View more
07-02-2021
09:49 AM
We upgraded to 8.0.6 and that resolved the issue.
... View more
10-06-2020
07:51 PM
We have a case open with Microsoft. We have the permissions specified here set accordingly. They asked us for a fiddler trace and while I was working on that, I was interrupted by an audit evidence request. When we get it sorted out I will post an update.
... View more
09-03-2020
03:04 PM
I resolved the issue by removing app and add-on from /opt/splunk/etc/shcluster/apps on the deployer and deploying ( to remove them from the search head ). Then I put the app and add-on back in /opt/splunk/etc/shcluster/apps and redeployed. This resolved the issue.
... View more
09-03-2020
12:46 PM
I am not making use of alert actions to manage your firewall from splunk TA. Intended to include that in my original reply...
... View more
09-03-2020
12:43 PM
def get_legacy_passwords(self):
if self.legacy_passwords is None:
self.legacy_passwords = {}
for pwd in self.client.storage_passwords.list(count=-1):
if pwd.realm == self.base_app_name:
self.legacy_passwords[pwd.username] = pwd
return self.legacy_passwords The above is what I noticed and also the snippet from the error messages below: self._migrate_conf_credential()\n File "/opt/splunk/etc/apps/Splunk_TA_paloalto/bin/splunk_ta_paloalto/aob_py3/splunk_aoblib/rest_migration.py I don't have the best grasp of Python, so maybe I'm way off base?
... View more
09-03-2020
11:47 AM
8.0.5 running on linux servers...
... View more
09-03-2020
09:18 AM
I updated my Palo Alto Networks Add-on to version 6.3.1 and now I'm seeing the errors below in splunkd.log on the search head cluster members the add-on is deployed to. 09-03-2020 09:54:10.323 -0500 ERROR AdminManagerExternal - Stack trace from python handler:\nTraceback (most recent call last):\n File "/opt/splunk/etc/apps/Splunk_TA_paloalto/bin/splunk_ta_paloalto/aob_py3/splunk_aoblib/rest_migration.py", line 19, in handle\n return func(*args, **kwargs)\n File "/opt/splunk/etc/apps/Splunk_TA_paloalto/bin/splunk_ta_paloalto/aob_py3/splunk_aoblib/rest_migration.py", line 71, in _migrate\n self._migrate_conf_credential()\n File "/opt/splunk/etc/apps/Splunk_TA_paloalto/bin/splunk_ta_paloalto/aob_py3/splunk_aoblib/rest_migration.py", line 161, in _migrate_conf_credential\n conf_file, stanzas = self._load_conf(conf_file_name)\n File "/opt/splunk/etc/apps/Splunk_TA_paloalto/bin/splunk_ta_paloalto/aob_py3/splunk_aoblib/rest_migration.py", line 178, in _load_conf\n stanzas = conf_file.get_all()\n File "/opt/splunk/etc/apps/Splunk_TA_paloalto/bin/splunk_ta_paloalto/aob_py3/solnlib/utils.py", line 159, in wrapper\n return func(*args, **kwargs)\n File "/opt/splunk/etc/apps/Splunk_TA_paloalto/bin/splunk_ta_paloalto/aob_py3/solnlib/conf_manager.py", line 241, in get_all\n key_values = self._decrypt_stanza(name, stanza_mgr.content)\n File "/opt/splunk/etc/apps/Splunk_TA_paloalto/bin/splunk_ta_paloalto/aob_py3/solnlib/conf_manager.py", line 126, in _decrypt_stanza\n self._cred_mgr.get_password(stanza_name))\n File "/opt/splunk/lib/python3.7/json/__init__.py", line 348, in loads\n return _default_decoder.decode(s)\n File "/opt/splunk/lib/python3.7/json/decoder.py", line 337, in decode\n obj, end = self.raw_decode(s, idx=_w(s, 0).end())\n File "/opt/splunk/lib/python3.7/json/decoder.py", line 355, in raw_decode\n raise JSONDecodeError("Expecting value", s, err.value) from None\njson.decoder.JSONDecodeError: Expecting value: line 1 column 1 (char 0)\n\nDuring handling of the above exception, another exception occurred:\n\nTraceback (most recent call last):\n File "/opt/splunk/lib/python3.7/site-packages/splunk/admin.py", line 148, in init\n hand.execute(info)\n File "/opt/splunk/lib/python3.7/site-packages/splunk/admin.py", line 634, in execute\n if self.requestedAction == ACTION_LIST: self.handleList(confInfo)\n File "/opt/splunk/etc/apps/Splunk_TA_paloalto/bin/splunk_ta_paloalto/aob_py3/splunk_aoblib/rest_migration.py", line 36, in handleList\n self._migrate()\n File "/opt/splunk/etc/apps/Splunk_TA_paloalto/bin/splunk_ta_paloalto/aob_py3/splunk_aoblib/rest_migration.py", line 23, in handle\n 'Migrating failed. %s' % traceback.format_exc()\nsplunktaucclib.rest_handler.error.RestError: REST Error [500]: Internal Server Error -- Migrating failed. Traceback (most recent call last):\n File "/opt/splunk/etc/apps/Splunk_TA_paloalto/bin/splunk_ta_paloalto/aob_py3/splunk_aoblib/rest_migration.py", line 19, in handle\n return func(*args, **kwargs)\n File "/opt/splunk/etc/apps/Splunk_TA_paloalto/bin/splunk_ta_paloalto/aob_py3/splunk_aoblib/rest_migration.py", line 71, in _migrate\n self._migrate_conf_credential()\n File "/opt/splunk/etc/apps/Splunk_TA_paloalto/bin/splunk_ta_paloalto/aob_py3/splunk_aoblib/rest_migration.py", line 161, in _migrate_conf_credential\n conf_file, stanzas = self._load_conf(conf_file_name)\n File "/opt/splunk/etc/apps/Splunk_TA_paloalto/bin/splunk_ta_paloalto/aob_py3/splunk_aoblib/rest_migration.py", line 178, in _load_conf\n stanzas = conf_file.get_all()\n File "/opt/splunk/etc/apps/Splunk_TA_paloalto/bin/splunk_ta_paloalto/aob_py3/solnlib/utils.py", line 159, in wrapper\n return func(*args, **kwargs)\n File "/opt/splunk/etc/apps/Splunk_TA_paloalto/bin/splunk_ta_paloalto/aob_py3/solnlib/conf_manager.py", line 241, in get_all\n key_values = self._decrypt_stanza(name, stanza_mgr.content)\n File "/opt/splunk/etc/apps/Splunk_TA_paloalto/bin/splunk_ta_paloalto/aob_py3/solnlib/conf_manager.py", line 126, in _decrypt_stanza\n self._cred_mgr.get_password(stanza_name))\n File "/opt/splunk/lib/python3.7/json/__init__.py", line 348, in loads\n return _default_decoder.decode(s)\n File "/opt/splunk/lib/python3.7/json/decoder.py", line 337, in decode\n obj, end = self.raw_decode(s, idx=_w(s, 0).end())\n File "/opt/splunk/lib/python3.7/json/decoder.py", line 355, in raw_decode\n raise JSONDecodeError("Expecting value", s, err.value) from None\njson.decoder.JSONDecodeError: Expecting value: line 1 column 1 (char 0)\n\n
09-03-2020 09:54:10.323 -0500 ERROR AdminManagerExternal - Unexpected error "<class 'splunktaucclib.rest_handler.error.RestError'>" from python handler: "REST Error [500]: Internal Server Error -- Migrating failed. Traceback (most recent call last):\n File "/opt/splunk/etc/apps/Splunk_TA_paloalto/bin/splunk_ta_paloalto/aob_py3/splunk_aoblib/rest_migration.py", line 19, in handle\n return func(*args, **kwargs)\n File "/opt/splunk/etc/apps/Splunk_TA_paloalto/bin/splunk_ta_paloalto/aob_py3/splunk_aoblib/rest_migration.py", line 71, in _migrate\n self._migrate_conf_credential()\n File "/opt/splunk/etc/apps/Splunk_TA_paloalto/bin/splunk_ta_paloalto/aob_py3/splunk_aoblib/rest_migration.py", line 161, in _migrate_conf_credential\n conf_file, stanzas = self._load_conf(conf_file_name)\n File "/opt/splunk/etc/apps/Splunk_TA_paloalto/bin/splunk_ta_paloalto/aob_py3/splunk_aoblib/rest_migration.py", line 178, in _load_conf\n stanzas = conf_file.get_all()\n File "/opt/splunk/etc/apps/Splunk_TA_paloalto/bin/splunk_ta_paloalto/aob_py3/solnlib/utils.py", line 159, in wrapper\n return func(*args, **kwargs)\n File "/opt/splunk/etc/apps/Splunk_TA_paloalto/bin/splunk_ta_paloalto/aob_py3/solnlib/conf_manager.py", line 241, in get_all\n key_values = self._decrypt_stanza(name, stanza_mgr.content)\n File "/opt/splunk/etc/apps/Splunk_TA_paloalto/bin/splunk_ta_paloalto/aob_py3/solnlib/conf_manager.py", line 126, in _decrypt_stanza\n self._cred_mgr.get_password(stanza_name))\n File "/opt/splunk/lib/python3.7/json/__init__.py", line 348, in loads\n return _default_decoder.decode(s)\n File "/opt/splunk/lib/python3.7/json/decoder.py", line 337, in decode\n obj, end = self.raw_decode(s, idx=_w(s, 0).end())\n File "/opt/splunk/lib/python3.7/json/decoder.py", line 355, in raw_decode\n raise JSONDecodeError("Expecting value", s, err.value) from None\njson.decoder.JSONDecodeError: Expecting value: line 1 column 1 (char 0)\n". See splunkd.log for more details. I took a look at rest_migration.py and it looks to me like it's looking for credentials from an older version of the TA that wasn't installed on my search heads (I'm not great with python, so I could be wrong). The add-on is deployed to a 4 member search head cluster with my deployer. Anyone have any ideas on how to resolve this? As it is, when i try to configure accounts or add-on settings in the app i just get a spinning wheel that says loading.
... View more
Labels
- Labels:
-
installation
09-02-2020
01:06 PM
I see now that this is a Highlighted Issue in the release notes. Hope they fix it soon...
... View more
08-31-2020
09:39 PM
Same issue here. After upgrading to 8.0.5 alerts that were working, don't work unless i change the owner to an admin user.
... View more
08-10-2020
02:44 PM
I installed version 3.0.1 of the Microsoft Azure Add-on for Splunk on one of our Heavy Forwarders. I was able to configure and get all the inputs working except "Microsoft Azure Active Directory Sign-ins", "Microsoft Azure Active Directory Users", and "Microsoft Azure Active Directory Audit" (I'm trying to avoid using the EventHub because of the necessary firewall rules, etc.). All of our Splunk servers are Linux and we have version 8.0.5 installed. The error I'm seeing is: 2020-08-10 16:25:11,467 ERROR pid=23994 tid=MainThread file=base_modinput.py:log_error:309 | Get error when collecting events.
Traceback (most recent call last):
File "/opt/splunk/etc/apps/TA-MS-AAD/bin/ta_ms_aad/aob_py3/modinput_wrapper/base_modinput.py", line 128, in stream_events
self.collect_events(ew)
File "/opt/splunk/etc/apps/TA-MS-AAD/bin/MS_AAD_signins.py", line 88, in collect_events
input_module.collect_events(self, ew)
File "/opt/splunk/etc/apps/TA-MS-AAD/bin/input_module_MS_AAD_signins.py", line 85, in collect_events
sign_in_response = azutils.get_items_batch(helper, access_token, url)
File "/opt/splunk/etc/apps/TA-MS-AAD/bin/ta_azure_utils/utils.py", line 55, in get_items_batch
raise e
File "/opt/splunk/etc/apps/TA-MS-AAD/bin/ta_azure_utils/utils.py", line 49, in get_items_batch
r.raise_for_status()
File "/opt/splunk/etc/apps/TA-MS-AAD/bin/ta_ms_aad/aob_py3/requests/models.py", line 940, in raise_for_status
raise HTTPError(http_error_msg, response=self)
requests.exceptions.HTTPError: 403 Client Error: Forbidden for url: https://graph.microsoft.com/beta/auditLogs/signIns?$orderby=createdDateTime&$filter=createdDateTime+gt+2020-08-09T16:25:10.822417Z+and+createdDateTime+le+2020-08-10T21:18:11.232754Z I assume this means the necessary permissions are not in place in Azure. Our Azure admin followed the "Setup an Azure AD Application Registration" documentation built-in to the app ( which is really nice btw ). He doublechecked and he did everything in the instructions. Any ideas on what we might be missing? I looked at the troubleshooting search and didn't come across anything that seemed to spell out what the problem was (beyond what the error above indicates).
... View more
Labels
- Labels:
-
configuration
12-13-2018
07:10 PM
Is there a way to have high availability for the REST Modular Input(without resorting to a load balancer)? What if the standalone search head/forwarder goes down?
... View more
09-05-2018
11:07 AM
The documentation here says: "This documentation applies to the following versions of Splunk® Enterprise: 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.3.6, 6.3.7, 6.3.8, 6.3.9, 6.3.10, 6.3.11, 6.3.12, 6.3.13, 6.4.0, 6.4.1, 6.4.2, 6.4.3, 6.4.4, 6.4.5, 6.4.6, 6.4.7, 6.4.8, 6.4.9, 6.4.10, 6.5.0, 6.5.1, 6.5.1612 (Splunk Cloud only), 6.5.2, 6.5.3, 6.5.4, 6.5.5, 6.5.6, 6.5.7, 6.5.8, 6.5.9, 6.6.0, 6.6.1, 6.6.2, 6.6.3, 6.6.4, 6.6.5, 6.6.6, 6.6.7, 6.6.8, 6.6.9, 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.1.0, 7.1.1, 7.1.2 " Are they meaning the version of Splunk on the Universal Forwarder or the version of Splunk on the server. In other words, if I have a Universal Forwarder running version 6.2.1, does that mean I need to deploy the Powershell add-on to that forwarder to be able to run a powershell script?
... View more
04-01-2018
08:39 PM
I noticed this before I posted. Somehow the fact that the Splunk Python SDK is going to support Python version 3 isn't very reassuring. If I do the command below on one of my search heads, I get over 1000 results. Splunk seems to use Python a lot, which is fine as long as they have a plan to migrate to Python 3, but does Splunk have a plan?
[splunk@hostname etc]$ find . -name "*.py*"
... View more
03-30-2018
07:29 AM
1 Karma
Is this on Splunk's roadmap? The clock is ticking...
https://pythonclock[.]org/
... View more
Labels
- Labels:
-
Python
05-22-2017
08:39 AM
2 Karma
By default, Splunk audit events coming from non-Windows universal forwarders are sent to the null queue by way of system default configuration in props.conf.
#system/default/props.conf
[source::.../var/log/splunk/audit.log(.\d+)?]
TRANSFORMS = send_to_nullqueue
sourcetype = splunk_audit
As a workaround, we deployed an app with a local props.conf and referenced a non-existing transform to override the default of send_to _nullqueue .
#spp_cluster_indexer_base
[source::.../var/log/splunk/audit.log(.\d+)?]
TRANSFORMS = nostanza
sourcetype = splunk_audit
... View more
02-17-2017
09:28 AM
When I search index=* host=theforwarderiamlookingfor , I only get results from index=os , which is the index that our /var/log/secure goes to. Does searching index=* search _internal _audit, etc?
I found a Linux forwarder with log entries for audit.log in the last 90 days. I have a case open with support. If we get to the bottom of this, I will update this question with the resolution.
... View more
02-16-2017
12:56 PM
I am in our Splunk admins AD group, but just to be certain I logged in as the user admin and searched index=_audit sourcetype=audittrail for the last 90 days.
The search returned 16,656,224 events, but the hosts were all splunk servers. Not anything from a host with the Universal Forwarder installed.
... View more
02-16-2017
11:46 AM
I did a search for the last 90 ( in our Production environment ) of index=_audit. All the results I find are from Linux servers running the Splunk server application. I don't find anything from a Linux server running the Splunk Universal Forwarder application.
I do think you are correct about audit.log being monitored by default, because I searched the Last 90 days (in a different environment) index=_internal sourcetype=splunk_audit and found 100's of Windows hosts logging messages from C:\Program Files\SplunkUniversalForwarder\var\log\splunk\audit.log.
The Production environment that I searched has 76 linux servers running the Universal Forwarder application. I found an /opt/splunkforwarder/var/log/splunk/audit.log/audit.log file with entries during that time frame.
... View more
02-15-2017
02:29 PM
Output from ./splunk list inputstatus. Not sure how how the percent is 100.11. Seem like that might be an indication of a problem...
[splunk@servername bin]$ ./splunk list inputstatus
Cooked:tcp :
tcp
ExecProcessor:exec commands :
./bin/pwchange.sh
exit status description = exited with code 0
time closed = 2017-02-15T16:19:43-0600
time opened = 2017-02-15T16:19:43-0600
total bytes = 59
Raw:tcp :
tcp
TailingProcessor:FileStatus :
$SPLUNK_HOME/etc/splunk.version
file position = 70
file size = 70
percent = 100.00
type = finished reading
$SPLUNK_HOME/var/log/splunk
type = directory
$SPLUNK_HOME/var/log/splunk/audit.log
type = directory
$SPLUNK_HOME/var/log/splunk/metrics.log
type = directory
$SPLUNK_HOME/var/log/splunk/splunkd.log
type = directory
$SPLUNK_HOME/var/spool/splunk/...stash_new
type = directory
$SPLUNK_HOME\var\log\splunk\audit.log
type = missing
/opt/splunkforwarder/var/log/splunk/audit.log
file position = 421540
file size = 421076
parent = $SPLUNK_HOME/var/log/splunk/audit.log
**percent = 100.11**
type = open file
/opt/splunkforwarder/var/log/splunk/btool.log
file position = 392432
file size = 392432
parent = $SPLUNK_HOME/var/log/splunk
percent = 100.00
type = finished reading
/opt/splunkforwarder/var/log/splunk/conf.log
file position = 15181
file size = 15181
parent = $SPLUNK_HOME/var/log/splunk
percent = 100.00
type = finished reading
/opt/splunkforwarder/var/log/splunk/first_install.log
file position = 70
file size = 70
parent = $SPLUNK_HOME/var/log/splunk
percent = 100.00
type = finished reading
/opt/splunkforwarder/var/log/splunk/license_usage.log
file position = 0
file size = 0
parent = $SPLUNK_HOME/var/log/splunk
percent = 100
type = finished reading
/opt/splunkforwarder/var/log/splunk/metrics.log
file position = 14180368
file size = 14180368
parent = $SPLUNK_HOME/var/log/splunk/metrics.log
percent = 100.00
type = open file
/opt/splunkforwarder/var/log/splunk/metrics.log.1
file position = 25000033
file size = 25000033
parent = $SPLUNK_HOME/var/log/splunk
percent = 100.00
type = finished reading
/opt/splunkforwarder/var/log/splunk/metrics.log.2
file position = 25000065
file size = 25000065
parent = $SPLUNK_HOME/var/log/splunk
percent = 100.00
type = finished reading
/opt/splunkforwarder/var/log/splunk/metrics.log.3
file position = 25000032
file size = 25000032
parent = $SPLUNK_HOME/var/log/splunk
percent = 100.00
type = finished reading
/opt/splunkforwarder/var/log/splunk/metrics.log.4
file position = 25000107
file size = 25000107
parent = $SPLUNK_HOME/var/log/splunk
percent = 100.00
type = finished reading
/opt/splunkforwarder/var/log/splunk/metrics.log.5
file position = 25000122
file size = 25000122
parent = $SPLUNK_HOME/var/log/splunk
percent = 100.00
type = finished reading
/opt/splunkforwarder/var/log/splunk/mongod.log
file position = 0
file size = 0
parent = $SPLUNK_HOME/var/log/splunk
percent = 100
type = finished reading
/opt/splunkforwarder/var/log/splunk/remote_searches.log
file position = 0
file size = 0
parent = $SPLUNK_HOME/var/log/splunk
percent = 100
type = finished reading
/opt/splunkforwarder/var/log/splunk/scheduler.log
file position = 0
file size = 0
parent = $SPLUNK_HOME/var/log/splunk
percent = 100
type = finished reading
/opt/splunkforwarder/var/log/splunk/searchhistory.log
file position = 0
file size = 0
parent = $SPLUNK_HOME/var/log/splunk
percent = 100
type = finished reading
/opt/splunkforwarder/var/log/splunk/splunkd-utility.log
file position = 40274
file size = 40274
parent = $SPLUNK_HOME/var/log/splunk
percent = 100.00
type = finished reading
/opt/splunkforwarder/var/log/splunk/splunkd.log
file position = 21189839
file size = 21189839
parent = $SPLUNK_HOME/var/log/splunk/splunkd.log
percent = 100.00
type = open file
/opt/splunkforwarder/var/log/splunk/splunkd.log.1
file position = 25000179
file size = 25000179
parent = $SPLUNK_HOME/var/log/splunk
percent = 100.00
type = finished reading
/opt/splunkforwarder/var/log/splunk/splunkd_access.log
file position = 634931
file size = 634931
parent = $SPLUNK_HOME/var/log/splunk
percent = 100.00
type = open file
/opt/splunkforwarder/var/log/splunk/splunkd_stderr.log
file position = 5939
file size = 5939
parent = $SPLUNK_HOME/var/log/splunk
percent = 100.00
type = finished reading
/opt/splunkforwarder/var/log/splunk/splunkd_stdout.log
file position = 14343
file size = 14343
parent = $SPLUNK_HOME/var/log/splunk
percent = 100.00
type = finished reading
/opt/splunkforwarder/var/log/splunk/splunkd_ui_access.log
file position = 0
file size = 0
parent = $SPLUNK_HOME/var/log/splunk
percent = 100
type = finished reading
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
01-02-2025
09:50 AM
|
