@Bazza_12  could you please clarify the part "append your site certs", is this referring to the contents under "splunk_ta_o365/lib/certifi/cacert.pem" ? ... View more

Hi @gcusello  What was the root cause & solution? and which Splunk version were you using? ... View more

@richgalloway how do I run the rebuild command for multiple files? I'm trying to rebuild the logs for 3 months, and I have hundreds of files, instead of running the rebuild command for each file one by one, is there any other way to run bulk? maybe wildcard or something? ... View more

Please read the complete config information: disableDefaultPort = <boolean> * If set to "true", turns off listening on the splunkd management port, which is 8089 by default. * On Universal Forwarders, when this value is "true" the value set for mgmtHostPort in web.conf will be ignored. Similarly, when set to "false", the value set for mgmtHostPort in web.conf will be used for binding management port. * NOTE: On Universal Forwarders, to reduce the risk of exploitation Splunk recommends the management port is disabled and local CLI is not used. If the management port is enabled, a valid TLS certification should be installed and the port should be bound to localhost. * NOTE: Changing this setting is not recommended on other Splunk instances. * This is the general communication path to splunkd. If it is disabled, there is no way to communicate with a running splunk instance. * This means many command line splunk invocations cannot function, Splunk Web cannot function, the REST interface cannot function, etc. * If you choose to disable the port anyway, understand that you are selecting reduced Splunk functionality. * Default: false ... View more

Hi @Azeemering thanks for your repsonse, about the crating my own app to parse the fields part...I'm not familiar with the props.conf & transforms.conf files. Any help you can give? ... View more

Actually we are planning a reboot of the NAS storage server, probably 10-20 minutes, during the time if any bucket rolling happens what will happen to that data, that's my requirement. ... View more

Can't we put the indexer/ cluster master in maintenance mode, so that the bucket rolling will stop temporarily? ... View more

Here it is,   {"AADGroupId": "3100c98b-8326-454458-003423", "CommunicationType": "Team", "CreationTime": "2022-03-17T08:11:51", "ExtraProperties": [], "Id": "9a706da1-cf0-c66248e", "ItemName": "xxxxxxx", "Members": [{"DisplayName": "def, abc", "Role": 1, "UPN": "abc@teams.com"}], "Operation": "MemberAdded", "OrganizationId": "e092a8e1", "RecordType": 25, "TeamGuid": "19:NMnHsgIOE_r6fULTi5XzydC9g1@thr.acv2", "TeamName": "xxxxxxx", "UserId": "abc@teams.com", "UserKey": "0b6cedcb-2a3386", "UserType": 0, "Version": 1, "Workload": "MicrosoftTeams"} {"AADGroupId": "0158b60c-34ba9b", "CommunicationType": "Team", "CreationTime": "2022-03-17T08:39:08", "ExtraProperties": [], "Id": "24214374ab6", "ItemName": "yyyyyyyyyy", "Members": [{"DisplayName": "def, abc", "Role": 3, "UPN": "abc@teams.com"}], "Operation": "MemberRemoved", "OrganizationId": "e092ae38-85aa8", "RecordType": 25, "TeamGuid": "19:ELsX6SdpXH5241@thr.acv2", "TeamName": "yyyyyyyyyy", "UserId": "abc@teams.com", "UserKey": "5f4381bd-7ed505", "UserType": 0, "Version": 1, "Workload": "MicrosoftTeams"} ... View more

I have Microsoft Teams data. ... View more