Hello ,   we are getting "0365 splunk addon data comes after delay of 1 day " Which version of Splunk are you currently using? Answer 8.2 Which app/add-on are you using to send the O365 data? Answer:-  Microsoft Graph Security Add-on for SplunkTA-microsoft-graph-security-add-on-for-splunk1.2.1 Thanks Lalit  ... View more

Hello Team, I am confused about SA , DA or TA as given in doc . "Splunk Enterprise Security The Splunk Enterprise Security package includes a set of add-ons. The add-ons that include "SA-" or "DA-" in the name make up the Splunk Enterprise Security framework. You do not need to take any additional action to deploy or configure these add-ons, because their installation and setup is handled as part of the Splunk Enterprise Security installation process. Do not disable any add-ons that make up the Splunk Enterprise Security framework. The rest of the add-ons include "TA-" in the name and are technology-specific and provide the CIM-compliant knowledge necessary to incorporate that source data into Enterprise Security. ... View more

Hello , I have one setup one indexer and one splunk search head. Indexer has 64 RAM and 16 CPU core and SH as 128 CPU and 32 core. Indexing per day 25 to 30 GB only. On investigation found all queues for fill ration are full . What should i do. Thanks Lalit ... View more

Hello , Need help for "Information is needed port data from azure to splunk" . We are able to connect azure from one splunk but not get data . But from other splunk , can connect and get data from other splunk. Thanks ... View more

Hello , How to parse csv (blob) data of azure to microsoft azure addon. we are not getting data from blobs csv file in right format. Thanks ... View more

Data from blobs csv coming from azure into splunk not coming into format only few scattered words. please suggest. Thanks ... View more

Hello Team, I have one question . we have to installed addon on heavy forwarded or indexer and then need to install on search head. we are configuring addon on HV/I and SH . Could you please suggest both are configured for data inputs and not make duplicate data. Thnk ... View more

Hello, I have integrated azure and splunk , getting data for blob storage and audit . But Unable data of table and resource of azure to splunk . 2019-04-21 11:39:55,371 +0000 log_level=ERROR, pid=4896, tid=MainThread, file=ta_mod_input.py, func_name=main, code_line_no=199 | Microsoft Cloudservices Storage Table task encounter exception Traceback (most recent call last): File "C:\Program Files\Splunk\etc\apps\Splunk_TA_microsoft-cloudservices\bin\splunktamscs\splunktaucclib\data_collection\ta_mod_input.py", line 196, in main config_cls=configer_cls, log_suffix=log_suffix) File "C:\Program Files\Splunk\etc\apps\Splunk_TA_microsoft-cloudservices\bin\splunktamscs\splunktaucclib\data_collection\ta_mod_input.py", line 145, in run loader.run(jobs) File "C:\Program Files\Splunk\etc\apps\Splunk_TA_microsoft-cloudservices\bin\splunktamscs\splunktaucclib\data_collection\ta_data_loader.py", line 61, in run self._wait_for_tear_down() File "C:\Program Files\Splunk\etc\apps\Splunk_TA_microsoft-cloudservices\bin\splunktamscs\splunktaucclib\data_collection\ta_data_loader.py", line 76, in _wait_for_tear_down go_exit = wakeup_q.get(timeout=1) File "C:\Program Files\Splunk\Python-2.7\Lib\Queue.py", line 177, in get self.not_empty.wait(remaining) File "C:\Program Files\Splunk\Python-2.7\Lib\threading.py", line 359, in wait _sleep(delay) IOError: [Errno 4] Interrupted function call 2019-04-21 11:39:55,371 +0000 log_level=ERROR, pid=3200, tid=MainThread, file=ta_mod_input.py, func_name=main, code_line_no=199 | Microsoft Cloudservices Azure Resource task encounter exception Traceback (most recent call last): File "C:\Program Files\Splunk\etc\apps\Splunk_TA_microsoft-cloudservices\bin\splunktamscs\splunktaucclib\data_collection\ta_mod_input.py", line 196, in main config_cls=configer_cls, log_suffix=log_suffix) File "C:\Program Files\Splunk\etc\apps\Splunk_TA_microsoft-cloudservices\bin\splunktamscs\splunktaucclib\data_collection\ta_mod_input.py", line 145, in run loader.run(jobs) File "C:\Program Files\Splunk\etc\apps\Splunk_TA_microsoft-cloudservices\bin\splunktamscs\splunktaucclib\data_collection\ta_data_loader.py", line 61, in run self._wait_for_tear_down() File "C:\Program Files\Splunk\etc\apps\Splunk_TA_microsoft-cloudservices\bin\splunktamscs\splunktaucclib\data_collection\ta_data_loader.py", line 76, in _wait_for_tear_down go_exit = wakeup_q.get(timeout=1) File "C:\Program Files\Splunk\Python-2.7\Lib\Queue.py", line 177, in get self.not_empty.wait(remaining) File "C:\Program Files\Splunk\Python-2.7\Lib\threading.py", line 359, in wait _sleep(delay) IOError: [Errno 4] Interrupted function call Collapse ... View more

Hello team, Need to know some basic query , need to monitor azure logs for storage and apps . Where we have to install heavy forwarder splunk . can suggest best method to integrate to these logs. Thanks ... View more

Hello, Alert not showing in alert manager dashboard. dashboard has no value . Thanks ... View more

Hello, the Fortinet Fortigate App for Splunk is not showing any data. search command sourcetype=fgt_traffic, or sourcetype=fgt_event, or sourcetype=fgt_utm also showing not data. Here:- index=fortinet_firewall sourcetype="fortinet:firewall" ... View more

Hello, No data on Ansible apps on splunk, i have done as below 1.Install this Ansible Monitoring & Diagnostics using the normal Splunk process 2.In Splunk add a HTTP Event Collector data input with a sourcetype of _json. Ensure to enable tokens and disable SSL 3.copy the splunk.py Ansible callback file, currently in the apps bin directory, into a directory within the root of your Ansible playbook called callback_plugins 4.Update your "ansible.cfg" with settings from the Splunk HTTP Event Collector data input as below In ansible.cfg at bottom callback_whitelist = splunk [callback_splunk] url = http://35.200.188.84:8088/services/collector/event authtoken = 2ecefa94-ffa5-4c81-af22-8e3eff29c612 ... View more

Hello, I have created one instance on trial for servicenow and created one user name servicenow and assigned role like import, itil. I have installed ServiceNow Security Operations add-on on splunk. try to trigger alert but can not sent incident. Thanks ... View more