So I've been looking at this blog post from 10 years ago: https://www.splunk.com/en_us/blog/security/storing-encrypted-credentials.html But what is outlined there does not seem to work. I have the following setup.xml file: <setup> <block title="Specify a Proofpoint token to access logs" endpoint="storage/passwords" entity="_new"> <input field="prooftoken"> <label>Proofpoint token</label> <type>password</type> </input> </block> </setup> Per the blog post my token should be stored in app.conf and that is simply not the case. I have a UI rendered asking me to specify a token (per the .XML above) but upon hitting save, I see no evidence of retention in any .conf file. ... View more

For some background, I originally installed the Cloud Services add-on with an enterprise trial license. I got busy with some other things and the license expired. So I've fallen back to the FREE license since I'm doing testing on my desktop. In the interim, I noticed the UI in the Add-On to configure things no longer shows anything. Previously I could go to Configuration and in the account tab, define something. I see the latter, but there's no longer any UI element to add an account. So I started following this document: http://docs.splunk.com/Documentation/AddOns/released/MSCloudServices/Configureaccount I've checked and rechecked my work and when I go to the TROUBLESHOOTING area, all I ever see is "No certificate configured yet." The only grey area for me was on the second part where it says: [certificate] private_key = I've broken my key across multiple lines like so (this isn't part of my actual key): private_key = DMDISBGYUKZIEDIIZMEMEK\ DKSKDKJZUAINJDFFOIUOIEAKDKDK\ DLSLZKIHROPTUNZLOITOOOIDODP\ In other words, I'm spanning the key private via "\". Not sure if I've inferred the setup documentation correctly. Lastly, when I searched my _internal index ("index=_internal sourcetype=ms*"), I saw way too many Python errors associated with the Microsoft Cloud Services Add-On: 12:45:53.493 PM 2016-08-26 19:45:53,493 +0000 log_level=ERROR, pid=5476, tid=MainThread, file=config.py, func_name=log, code_line_no=50 | UCC Config Module: Fail to load endpoint "ucc_system_snapshot" - Unspecified internal server error. reason={"messages":[{"type":"ERROR","text":"\n In handler 'ta_o365_server_ucc_system_snapshot': External handler failed with code '1' and output: 'REST ERROR[403]: Unauthorized client for the requested action - capability=ta_o365_get_credential'. See splunkd.log for stderr output."}]} File "C:\Program Files\Splunk\etc\apps\Splunk_TA_microsoft-cloudservices\bin\ms_o365_ucc_server.py", line 13, in modular_input.main(schema_file_path) File "C:\Program Files\Splunk\etc\apps\Splunk_TA_microsoft-cloudservices\bin\splunk_ta_microsoft_cloudservices\splunktaucclib\ucc_server\ucc_server_modular_input.py", line 178, in main exit_status = run(ucc_setting) File "C:\Program Files\Splunk\etc\apps\Splunk_TA_microsoft-cloudservices\bin\splunk_ta_microsoft_cloudservices\splunktaucclib\ucc_server\ucc_server_modular_input.py", line 132, in run ucc_server_id = ucc_config_loader.get_ucc_server_id(create_if_empty=False) File "C:\Program Files\Splunk\etc\apps\Splunk_TA_microsoft-cloudservices\bin\splunk_ta_microsoft_cloudservices\splunktaucclib\ucc_server\ucc_server_config.py", line 52, in get_ucc_server_id us_input = self.load_ucc_server_input() File "C:\Program Files\Splunk\etc\apps\Splunk_TA_microsoft-cloudservices\bin\splunk_ta_microsoft_cloudservices\splunktaucclib\ucc_server\ucc_server_config.py", line 43, in load_ucc_server_input self.ucc_server_input_cache = self.ucc_config.load() File "C:\Program Files\Splunk\etc\apps\Splunk_TA_microsoft-cloudservices\bin\splunk_ta_microsoft_cloudservices\splunktaucclib\config.py", line 126, in load log(msg, level=logging.ERROR, need_tb=True) File "C:\Program Files\Splunk\etc\apps\Splunk_TA_microsoft-cloudservices\bin\splunk_ta_microsoft_cloudservices\splunktaucclib\config.py", line 48, in log stack = ''.join(traceback.format_stack()) 016-08-26 19:45:53,444 +0000 log_level=ERROR, pid=16944, tid=MainThread, file=config.py, func_name=log, code_line_no=50 | UCC Config Module: Fail to load endpoint "management_api_input_list" - Unspecified internal server error. reason={"messages":[{"type":"ERROR","text":"\n In handler 'ta_o365_server_management_api_inputs': External handler failed with code '1' and output: 'REST ERROR[403]: Unauthorized client for the requested action - capability=ta_o365_configuration'. See splunkd.log for stderr output."}]} File "C:\Program Files\Splunk\etc\apps\Splunk_TA_microsoft-cloudservices\bin\ms_o365_account_monitoring.py", line 286, in main() File "C:\Program Files\Splunk\etc\apps\Splunk_TA_microsoft-cloudservices\bin\ms_o365_account_monitoring.py", line 278, in main run() File "C:\Program Files\Splunk\etc\apps\Splunk_TA_microsoft-cloudservices\bin\ms_o365_account_monitoring.py", line 144, in run conf_handler = oh.ConfigFileHandler(meta_configs, params.server_schema) File "C:\Program Files\Splunk\etc\apps\Splunk_TA_microsoft-cloudservices\bin\splunk_ta_microsoft_cloudservices\o365_helper.py", line 417, in init self._load_files() File "C:\Program Files\Splunk\etc\apps\Splunk_TA_microsoft-cloudservices\bin\splunk_ta_microsoft_cloudservices\o365_helper.py", line 427, in _load_files self._all_conf_content = self._conf.load() File "C:\Program Files\Splunk\etc\apps\Splunk_TA_microsoft-cloudservices\bin\splunk_ta_microsoft_cloudservices\splunktaucclib\config.py", line 126, in load log(msg, level=logging.ERROR, need_tb=True) File "C:\Program Files\Splunk\etc\apps\Splunk_TA_microsoft-cloudservices\bin\splunk_ta_microsoft_cloudservices\splunktaucclib\config.py", line 48, in log stack = ''.join(traceback.format_stack()) ... View more

I want to add a secondary web interface listener, i.e., something outside of port 8000. The ultimate goal is to then add SSL to this secondary listener and update various internal documentation to point to this new port (after I have SSL running on it). I don't want to immediately add SSL to the existing port (8000). Anyway, everything I've found seems to talk about adding a listener for the purpose of pumping data into Splunk, which isn't what I want. I want the web interface on a secondary TCP port. ... View more

I downloaded the following Add-on: http://blogs.splunk.com/2016/04/18/announcing-splunk-add-on-for-microsoft-cloud-services/ I went into "Apps" then selected "Install app from file" and directed it to the tar.gz I downloaded. While the Add-on shows up in the "Apps" section on the Home page, clicking on either "Inputs" or "Configuration" shows what appears to be broken HTML (up top) and further down clicking on "Inputs" shows nothing and clicking on "Configuration" and selecting one of the tabs (Account, Proxy, etc.) shows nothing. Does this Add-on require some minimum version of Splunk? I'm on 6.1.3. If not, the App found inside the .tar.gz would appear to be buggy. Neither the README directory or the README.TXT in the download were useful. ... View more