About mlasky1970

mlasky1970 · ‎04-27-2022

I have the Splunk Add-on for Microsoft Cloud Services (https://splunkbase.splunk.com/app/3110/) installed on my heavy forwarder and ingesting audit data from an event hub input configured as a central repository for our tenant's audit data. This is working like a champ. I see tons of event hub data, it's all parsing as expected. I'd love to use some dashboards to avoid making my own. I saw that the Microsoft Azure App for Splunk contains dashboards (https://splunkbase.splunk.com/app/4882/) for data collected from both the Cloud Services add-on above as well as the standard Azure add-on. Seems like what I want. However, after deploying the app to my SHC none of the dashboards work. Digging further into it it appears that the sourcetype the App is looking for is totally different than the sourcetype that the MCS add-on generates. All the events in the index are sourcetype=mscs:azure:eventhub but the App is looking for sourcetype=azure:eventhub. The question is, is the App actually supposed to work with the MCS add-on and if so does anyone have advice on making that work? Or is there a different app that provides dashboards for the data ingested by the MCS add-on? It looks like I could change the sourcetype in the configuration of the App but that doesn't feel like something I should be changing when the description says it works with the add-on.

mlasky1970 · ‎04-22-2022

Uhm, okay. Yeah. Replying to myself. There appears to be some ambiguity around the JIRA account configuration inside the TA. Specifically here: I had what I thought was a logical name in there. In fact, I had tried multiple logical names. However, the names I tried included special characters (a hyphen) and capitalization, both all caps and camel case. I also named it, during one attempt, the same as the JIRA username. None of these worked. I then deleted the accounts in the TA and started again. This time I created an account with a single lowercase word that had nothing at all to do with anything. This time the TA populated the list of projects. When I attempt to save a search and select the TA as an action it works and allows me to choose the Project I want. Way more close to functioning than previously. Hopefully the weirdness with the account name I describe above will help someone else with the same issue. Thanks to those that attempted to help me, much appreciated.

mlasky1970 · ‎04-22-2022

They are coming from search_messages.log. And yes, I downloaded it from Splunkbase last week. I can use the search head deployer to remove it and reinstall it if we think that might be useful. Not like it's working now so there is nothing to lose. I didn't misinterpret the documentation did I? It only needs to be on the SHC?

mlasky1970 · ‎04-22-2022

Lots of the decoder.py errors. I re-ran the curl without the -k, that was just habit 🙂 I got the same response as before, it returns data. I wouldn't put it past me to have deployed this wrong. From the documentation it looked like it just needed to be installed on the SHC, which is where I installed it. Thoughts?

mlasky1970 · ‎04-21-2022

I've got the Add-on for Atlassian JIRA Service Desk alert action plugin installed (https://splunkbase.splunk.com/app/4958/) on my search head cluster so I can create tickets from searches and alerts however I am having trouble getting the TA to talk to JIRA. I've created an internal JIRA user on our JIRA deployment, validated the credentials work by logging into JIRA with them, so I know my credentials are okay. The configuration section in the TA accepts the credentials. However, when I go to the app and ask it to show me projects or, for that matter, anything, it returns 0 projects and 0 results. All the canned reports return a Python error in the UI. Following a different thread I checked the troubleshooting steps at https://ta-jira-service-desk-simple-addon.readthedocs.io/en/latest/troubleshoot.html where it specifically talks about Python errors and how that tends to me there is a connectivity issue or credential issue. I ran the curl commands from the search head I was connected to and it can successfully connect to JIRA and pull data back! [root@splunk-head-2 ~]# curl -k https://jira.mystuff.com/rest/api/latest/project --user prodsec-splunk Enter host password for user 'prodsec-splunk': [{"expand":"description,lead,url,projectKeys","self":"https://jira.mystuff.com/rest/api/2/project/15334","id":"15334","key":"VFR","name":" Vermin Feature Request","avatarUrls":{"48x48":"https://jira.mystuff.com/secure/projectavatar?avatarId=15163","24x24":"https://jira.mystuff.com/secure/projectavatar?size=small&avatarId=15163","16x16":"https://jira.mystuff.com/secure/project So I have good credentials and end to end connectivity. I am not sure how to troubleshoot further...

mlasky1970 · ‎04-13-2022

Greetings folks. I installed the TA-ms-teams-alert-action to... you probably guessed... send alert messages to Teams. After installation exactly two messages were sent successfully to Teams. I even took screenshots. I recently realized I had not received any messages for events that I knew had happened so I started digging. Looks like a lot of messages are stuck in a resending state. Further digging in the logs indicates that when the TA tried to send a message to the Teams webhook it received a 404: 2022-04-06 00:35:45,922 ERROR pid=123018 tid=MainThread file=cim_actions.py:message:280 | sendmodaction - signature="Microsoft Teams publish to channel has failed!. url=https://totallyvalid.webhook.office.com/webhookb2/XXXXX , data={ }, HTTP Error=404, HTTP Reason=Not Found, HTTP content=<!DOCTYPE html> <span><H1>Server Error in '/WebhookB2' Application.<hr width=100% size=1 color=silver></H1> <h2> <i>The resource cannot be found.</i> </h2></span> <font face="Arial, Helvetica, Geneva, SunSans-Regular, sans-serif "> <b> Description: </b>HTTP 404. The resource you are looking for (or one of its dependencies) could have been removed, had its name changed, or is temporarily unavailable.  Please review the following URL and make sure that it is spelled correctly. <br><br> <b> Requested URL: </b>/webhookb2/XXXXX<br><br> I am unclear how to proceed. I've changed the web hook URLs above for privacy but the hooks in the logs and in the TA match the hooks in the Teams connector configuration. I know the webhooks work because they are in use by other tools and are not failing. I tested the webhooks from my laptop and was able to send a message. I tested the webhook from a search head and was able to send a message. Something appears to be munging the web hook URL but I cannot determine how or where. And since it worked previously and has not changed (I am the only person with access) I can't figure it out. I suspect that this line "Server Error in '/WebhookB2' Application." is relevant. This is on Splunk Enterprise 8.2.2.2. Thoughts or strategies would be appreciated.

Posts	7
Solutions	0
Karma Given	0
Karma Received	0
Member Since	‎04-13-2022

Online Status	Offline
Date Last Visited	‎04-28-2022 09:54 AM

Does Splunk work with the Microsoft Cloud Services...

Why is Add-on for Atlassian JIRA Service Desk aler...

TA-ms-teams-alert-action not sending messages to T...

Does Splunk work with the Microsoft Cloud Services...

Re: Add-on for Atlassian JIRA Service Desk alert a...

Re: Add-on for Atlassian JIRA Service Desk alert a...

Re: Add-on for Atlassian JIRA Service Desk alert a...

Why is Add-on for Atlassian JIRA Service Desk aler...

TA-ms-teams-alert-action not sending messages to T...