same issue, unable to authenticate with 2.70 and 8.04 ... View more

Anyone try this on db connect 3.30? ... View more

so, after trying a number of configurations, using the pat key AND restarting splunk made it work. Thanks ... View more

Yes, we have opened a ticket with Sailpoint. I would suggest clarifying that information in the app docs. We have generating that pat key, and followed sailpoints guidance. We are waiting on next steps. Thanks ... View more

yes, we are a customer, we found only documents, that refer to other documents that go nowhere. some say to create a Personal Access Token which client id and secrets are you referring to in the splunk addon? in the sailpoint admin section there are many options to configure client id and secrets. The splunk document has no specifics, what is the "Please enter your organization/tenant name" your are asking for, looks like the format is https://url, which client ids are you requesting? ... View more

Caused by NewConnectionError(': Failed to establish a new connection: [Errno -2] Name or service not known ... View more

yea, docs are light and so far not working for me... ... View more

Clean install of OS and Clean Install of Splunk ... View more

10-31-2019 13:57:50.541 ERROR ChunkedExternProcessor - stderr: File "/opt/splunk/etc/apps/SplunkEnterpriseSecuritySuite/bin/install/essinstaller2.py", line 539, in stage_postinstall 10-31-2019 13:57:50.541 ERROR ChunkedExternProcessor - stderr: self.postinstall(session_key) 10-31-2019 13:57:50.541 ERROR ChunkedExternProcessor - stderr: File "/opt/splunk/etc/apps/SplunkEnterpriseSecuritySuite/bin/install/essinstaller2.py", line 303, in _postinstall 10-31-2019 13:57:50.541 ERROR ChunkedExternProcessor - stderr: raise InstallException(str(e)) 10-31-2019 13:57:50.541 ERROR ChunkedExternProcessor - stderr: InstallException: Error retrieving manager inputs to deploy 10-31-2019 13:57:50.541 ERROR ChunkedExternProcessor - stderr: postinstall failed. 10-31-2019 13:57:50.547 INFO ReducePhaseExecutor - Ending phase_1 10-31-2019 13:57:50.547 INFO UserManager - Unwound user context: admin -> NULL 10-31-2019 13:57:50.547 INFO DispatchManager - DispatchManager::dispatchHasFinished(id='adminadminSplunkEnterpriseSecuritySuite_RMD5ba60899908b7f811_1572544503.5', username='admin') 10-31-2019 13:57:50.549 INFO UserManager - Unwound user context: admin -> NULL 10-31-2019 13:57:50.552 INFO UserManager - Unwound user context: admin -> NULL 10-31-2019 13:57:50.552 INFO UserManager - Unwound user context: admin -> NULL 10-31-2019 13:57:50.552 INFO UserManager - Unwound user context: admin -> NULL 10-31-2019 13:57:50.552 INFO UserManager - Unwound user context: admin -> NULL 10-31-2019 13:57:50.552 INFO UserManager - Unwound user context: admin -> NULL 10-31-2019 13:57:50.552 INFO UserManager - Unwound user context: admin -> NULL 10-31-2019 13:57:50.555 INFO UserManager - Unwound user context: admin -> NULL 10-31-2019 13:57:50.555 INFO PipelineComponent - Process delayed by 165.915 seconds, perhaps system was suspended? ... View more

getting permissions errors, the documentation is not quite clear, or current for o365, the o365 admins are stuck, I can see permission errors and they have no idea what to change... ... View more

you have to copy over a .py file that support gives you. ... View more

It really shows poor support when you cant download full pdf's, I get the documentation isn't that great in the first place, but downloading a few pages at a time is not acceptable. I know splunk loves to push pro-services but providing minimal and often missing or incorrect manuals is not the way to go. ... View more

Does domain actually make a difference. the documentation is horrible, changes from 4.30 to 4.32 have not been updated in the documentation and in general just near useless, I am finding contact PS as the default answer. ... View more

same problem, I am going to open a support ticket to get it working. ... View more

Good luck - He must have been Just kidding, the "features" I think are more of a money grab to have PS install it. So its made as cryptic as possible. ... View more

Load the Optive Threat intel app then use index=main dest_ip=* | lookup local=1 all_dest_ips.csv dest_ip OUTPUT threat_list_name, dest_ip | search threat_list_name=* | dedup dest_ip | eval dest_ip=mvindex(dest_ip,0) ... View more