Found a workaround. This should not be permanent but just until a fix is found. In my previous post I identified that the problem is with some DLL. Decided to omit the troubled line from the code in the first .py script. GoTo-->C:\Program Files\Splunk\etc\apps\TA-MS-AAD\bin(or whatever your Splunk Directory is) --> edit azure_event_hub.py --> go to line 14 --> and place a pound(#) sign in front of the line it should look like this (#import input_module_azure_event_hub as input_module) --> then got to line 117 and do the same (#exitcode = ModInputazure_event_hub().run(sys.argv)) --> then go to line 118 and remove the word exitcode from with in parenthesis so it would look like this (sys.exit()) --> Be sure to restart splunk for Input tab to start working. Thanks, Arthur ... View more

Was there ever a fix for this issue? Further investigation: I ran in admin cmd window cd C:\Program Files\Splunk\etc\apps\TA-MS-AAD\bin python azure_event_hub.py Got the following output: "Traceback (most recent call last): File "azure_event_hub.py", line 14, in import input_module_azure_event_hub as input_module File "C:\Program Files\Splunk\etc\apps\TA-MS-AAD\bin\input_module_azure_event_ hub.py", line 10, in from azure.eventhub import EventHubClient, EventData, EventPosition File "C:\Program Files\Splunk\etc\apps\TA-MS-AAD\bin\azure\eventhub_init.p y", line 8, in from azure.eventhub.common import EventData, EventDataBatch, EventPosition File "C:\Program Files\Splunk\etc\apps\TA-MS-AAD\bin\azure\eventhub\common.py" , line 13, in from azure.eventhub.error import EventDataError File "C:\Program Files\Splunk\etc\apps\TA-MS-AAD\bin\azure\eventhub\error.py", line 9, in from uamqp import constants, errors, compat File "C:\Program Files\Splunk\etc\apps\TA-MS-AAD\bin\uamqp__init_.py", line 17, in from uamqp.windows import c_uamqp # pylint: disable=import-self ImportError: DLL load failed: The specified module could not be found." The version is 2.0.2 If anyone knows what DLL is missing please let us know. Thank you, Arthur ... View more

Tried contacting Splunk support and this is the response I got "After reviewing the information, I see that this app/addon is not supported. Here you have more insights about App support types: https://docs.splunk.com/Documentation/Splunkbase/splunkbase/Splunkbase/Appsupporttypes As a best-effort from my side, here you have some information that can be helpful for you. It seems that some of our users are facing the same issue because developer (Splunk Works which is not us) which have created an upgrade with some errors. I advise you to downgrade the version of Microsoft Azure Add on for Splunk until the developer comes up with a fully working version" I downgraded to version 1.2.4, everything is working again. Arthur ... View more

I have the same exact issue. Any resolution? thank you, ... View more

Hi I am having the same issue. Were you able to get this search working? Particularly the macro that is not working is called ms_ad_obj_all_changes_base from "MS Windows AD Objects" app. The search is "eventtype=ms_ad_obj_wineventlog_security [|inputlookup AD_Audit_Change_EventCodes | stats values(EventCode) AS EventCode by obj_type | format | table search] src_user_type="user" | search NOT(EventCode=4723 AND src_user!=user)". When ran separately "|inputlookup AD_Audit_Change_EventCodes | stats values(EventCode) AS EventCode by obj_type | format | table search" or "eventtype=ms_ad_obj_wineventlog_security" I get results but when put together I get no results. I have checked macro, file and definition permissions all look intact. Also tried separating everything from each other in the search no luck. Thank you for any help in this. ... View more

Great thanks, learned something new. Two backslashes did the trick. ... View more

Yes exactly, I went to correct my mistake but saw that I wrote it correctly but it displays incorrect. How do I wright it in red the way you do? ... View more

Might need to add "edit-scripted" capability to the Role you are doing this with. ... View more

Hi, thank you this fix worked for me. Just to clarify as I am new to Splunk the Index time props.conf you are referring to is located at: $SPLUNK_HOME/etc/system/local. And the sourcetype asked about in this case is Windows Event Logs so my stanza looks like this: [WinEventLog] SEDCMD-remove_ffff = s/::ffff://g I realized that this works only after Splunk has been restarted. Regards, ... View more