All Apps and Add-ons

Is there a way to get this addon to connect to https://reports.office365.com through a http proxy?

xvieni
Engager

I am setting this addon up on a heavy forwarder (6.5), running on a debian linux. I am required to access the "internet" through a http proxy, without authentication and without inspection.
I cant find anywhere to configure the settings for the proxy server.

And since this is a O365 URL, the number of IP addresses returned when querying it is far to many to be manageable in a "through firewall" opening directly without a proxy server.

Did anyone get this to work through a http proxy, where the Splunk installation is not on a windows box?
(I noticed in the script "socks.py" that it imports the global proxy settings if the OS in "NT something")

0 Karma

jconger
Splunk Employee
Splunk Employee

Proxy support will be available in the next release. In the meantime, you can edit input_module_ms_o365_message_trace.py. Around line 57, you will see the following:

helper.log_debug("Endpoint URL: %s" % microsoft_trace_url)
r = requests.get(microsoft_trace_url, auth=requests.auth.HTTPBasicAuth(global_microsoft_office_365_username, global_microsoft_office_365_password))

The add-on uses the Python requests library which supports proxy servers. Make the following modifications:

helper.log_debug("Endpoint URL: %s" % microsoft_trace_url)
proxies = {
    'http': 'http://proxy_server_address:proxy_server_port',
    'https': 'http://proxy_server_address:proxy_server_port',
}
r = requests.get(microsoft_trace_url, proxies=proxies, auth=requests.auth.HTTPBasicAuth(global_microsoft_office_365_username, global_microsoft_office_365_password ))
0 Karma

faisal_saifi
New Member

Hi Jconger,
i have added following
proxies = {
'http': 'http://1.2.3.4:8080',
'https': 'http://1.2.3.4:8080',
}
But getting following error after restarting the splunk service.
"unable to initialise modular input'ms_o365_message_trace' defined inside the app 'TA-MS_o365_reporting' :introspecting scheme=ms_o365_message_trace : script running failed (exited with code 1)"

0 Karma

jconger
Splunk Employee
Splunk Employee

Check out the _internal index to get some more detail. The following search should help:

index=_internal source=*trace* error
0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...