Is there a splunk add on available that can provide Azure O365 AD group members list into Splunk?   Eg: on querying for group1@domain.com It should return member1@domain.com, member2@domain.com   I found few add ons but they seem to be for logging/monitoring purposes like who changed what and when. Did not find anything like say Microsoft graph via Splunk to list groups, get group members etc ... View more

I am able to fetch data using filter as query=json.dumps({'status': 'Fixed'}) But, am not able to filter data for multiple values. Its either giving data for only one of the two values or not giving data at all or giving some kind of an error. I want to do something like query=json.dumps({'status': ['Fixed', 'New']}) code: import json import splunklib.client as client service = client.connect( host='xxxx', port=xxxx, username='xxxx', password='xxxxx', owner='xxxxx', app='xxxx') collection = service.kvstore['xxxx'] response = collection.data.query(********) --> pass a query here print(response) ... View more

How to paginate results from kv store collection.data.query()? because if i fetch results as it is, I get limited number of records, while the real number of records are huge. More likely, it is because of the size of data fetched rather than the record numbers. It is able to fetch data which when stored in txt is upto 50-55 mb only. code: import json import splunklib.client as client service = client.connect( host='xxxx', port=xxxx, username='xxxx', password='xxxxx', owner='xxxxx', app='xxxx') collection = service.kvstore['xxxx'] # kv store name response = collection.data.query() print(len(response)) ... View more