The Azure Add on seems to be working well with the exception of how behind it is. Specifically for the signins (sourcetype azure:aad:signin). I can see in the add on logs on the heavy forwarder, that it is pulling in data, but the most recent event is May 4th as of now.  So it appears as though it's pulling in data as of 30 days ago, but it's just very slowly making headway.  My input for the sign ins is set to a 900 second interval (I messed around with this a little bit but didn't really seem to help). The Query limit is set to 0 and the query backoff throttle is set to 5. Any suggestions on how to speed this up? ... View more

I'm running a heavy forwarder on Redhat which I recently upgraded to Splunk Enterprise 8.1.1. Most apps survived the upgrade without issue. The Splunk estreamer app (https://splunkbase.splunk.com/app/3662/) however, doesn't seem to be working anymore. It works for a little while, but then I get the following:   Monitor ERROR [no message or attrs]: ProxyProcess[name=subscriberParser].request(status) timeout This is often appears soon after this: ERROR [no message or attrs]: 'View' object has no attribute '_View__isHex'\n'View' object has no attribute '_View__isHex'Traceback (most recent call last):\n File "/opt/splunk/etc/apps/TA-eStreamer/bin/encore/estreamer/baseproc.py", line 209, in receiveInput\n self.onReceive( item )\n File "/opt/splunk/etc/apps/TA-eStreamer/bin/encore/estreamer/pipeline.py", line 350, in onReceive\n _do( items )\n File "/opt/splunk/etc/apps/TA-eStreamer/bin/encore/estreamer/pipeline.py", line 344, in _do\n self.onEvent( item )\n File "/opt/splunk/etc/apps/TA-eStreamer/bin/encore/estreamer/pipeline.py", line 338, in onEvent\n decorate( item['record'], self.settings )\n File "/opt/splunk/etc/apps/TA-eStreamer/bin/encore/estreamer/pipeline.py", line 185, in decorate\n settings.cache(), record ).create()\n File "/opt/splunk/etc/apps/TA-eStreamer/bin/encore/estreamer/metadata/view.py", line 532, in create\n if(self.__isHex(hex32)) :\nAttributeError: 'View' object has no attribute '_View__isHex'\n I've tried downloading the latest version of the app, no change. To get it working again, I have to disable the 3 scripts that bring in the data, kill the PID's running the estreamer, then re-enable the scripts. Sometimes it works again for a few hours. Sometimes a few minutes. Any suggestions?  Also, something worth mentioning: I noticed when I go to manage apps, there's no "set up" option for this add on or the firepower splunk app, which is normally where I'd do the config for this.        ... View more

A couple of weeks ago, I migrated my Splunk server from one Windows Server to another. Same specs, just more capacity. However, when I look at the "License Usage - Previous 30 Days" prebuilt dashboard, the only option for "License Masters" that I have is the old server. The latest license usage data that I have is the day of the migration. I confirmed that the new server is acting as the master, with no errors. Any suggestions? ... View more

Does anyone have any guides around pulling down Dynamics 365 logs? I already have o365 logs being pulled down but I'm not seeing any Dynamics 365 data. I see in the Microsoft Office 365 App for Splunk dashboard, there's a "sourcetype="o365:service:message" WorkloadDisplayName="Dynamics 365"". However, it's not pulling anything in. Is there some documentation out there for D365 logging and ingestion? I didn't have much luck finding any. ... View more