Hi @sumeet1503 , There is another topic on this subject https://community.splunk.com/t5/All-Apps-and-Add-ons/Issues-fetching-Exchange-Online-message-tracking-logs-HTTP-401/m-p/638599 It seems Microsoft changed something and Splunk is working on an update for the app. Maybe the old app is still working https://splunkbase.splunk.com/app/3720 haven't tried it yet. Best regards, S. ... View more

Hi @althomas, We had the same problem as you do but with another field. First thing to do is check in the search.log of your search to check all the parsing that is applied. For us, it was not explicit at all and I had to check all the TAs one by one but finally manage to see what happened. If I can suggest, a first step would be to check all the transforms.conf and see if you have the same source_key and dest_key for a unique stanza: [<custom_stanza>] SOURCE_KEY = user REGEX = ^(\S+)\s+.*$ FORMAT = user::$1 This example is not correct because having the same src and dest creates a loop and somehow messes with other stuff. The dest can be: The DEST_KEY; A capturing field in REGEX (?...); The left field within the FORMAT. Hope this will help. Regards, S. ... View more

Hi, We asked the support, the only solution was a downgrade for us. ... View more

Hi tom8h, Late reply but I just solve this for us two days ago. First of all, those are just warnings so no worries. You can remove that by adding an empty file XXX.spec in the README directory for the first one, it would be /opt/splunk/etc/users/admin/splunk_app_db_connect/REAMDE/dbx-ui-conn-prefs.conf.spec Best Regards, S. ... View more