All Apps and Add-ons

Splunk Add-on for Microsoft Cloud Services with proxy?

szabados
Communicator

I'm trying to use the above add-on to get Azure Audit logs, and I want to use a proxy. Everything is configured according to the docs, but any time the script tries to download the data, I'm getting 10061.
I double checked with wireshark, the script is not even trying to connect to my proxy, instead it tries connecting directly to the Microsoft servers. I'm running on a Windows server.

How can I get this working ?

fatemabw
New Member

Figured it out.
Got it to working.
There is a config file inside the apps folder under the add-on, where the proxy settings has to be explicitly mentioned.

Under: /opt/splunk/etc/apps/Splunk_TA_microsoft-cloudservices/local/splunk_ta_ms_o365_client_settings.conf
[proxy]
proxy_enabled = 1
proxy_rdns = 1
proxy_type = http

proxy_password = password of proxy account

proxy_port = 8000
proxy_url = proxy1.your.server.com
disabled = 0

proxy_username = user name of proxy account

0 Karma

oljaszubs
Engager

I have the same issue - I can't see any traffic to be forwarded to provided proxy. Does anybody manage it to run ?

0 Karma

fatemabw
New Member

I am also struggling with the same. I have followed the doc to install, and since the forwarder is sitting behind a proxy, which majority of deployments do, can't connect to the proxy, instead Splunk forwarder is trying to directly connect to the MS cloud IP.
I have tried setting the proxy config in splunk-launch.conf, server.conf but nothing seem to work.

Has anyone figured out the solution?

Appreciate the help and comments!

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...