topic Re: task config has no interval in All Apps and Add-ons

task config has no interval

davebo1896 — Mon, 16 Apr 2018 20:38:42 GMT

Not getting and Azure Audit logs after setup. We are on-prem. Any ideas?

Seeing this error in the logs:
2018-04-16 20:30:20,975 +0000 log_level=ERROR, pid=17164, tid=MainThread, file=ta_mod_input.py, func_name=main, code_line_no=199 | Microsoft Cloudservices Azure Audit task encounter exception Traceback (most recent call last): File "/app/install/splunk/etc/apps/Splunk_TA_microsoft-cloudservices/bin/splunktamscs/splunktaucclib/data_collection/ta_mod_input.py", line 196, in main config_cls=configer_cls, log_suffix=log_suffix) File "/app/install/splunk/etc/apps/Splunk_TA_microsoft-cloudservices/bin/splunktamscs/splunktaucclib/data_collection/ta_mod_input.py", line 111, in run tconfig = tc.create_ta_config(settings, config_cls or tc.TaConfig, log_suffix) File "/app/install/splunk/etc/apps/Splunk_TA_microsoft-cloudservices/bin/splunktamscs/splunktaucclib/data_collection/ta_config.py", line 203, in create_ta_config return config_cls(meta_config, settings, stanza_name, log_suffix) File "/app/install/splunk/etc/apps/Splunk_TA_microsoft-cloudservices/bin/splunktamscs/splunktaucclib/data_collection/ta_config.py", line 31, in __init__ self._load_task_configs() File "/app/install/splunk/etc/apps/Splunk_TA_microsoft-cloudservices/bin/splunktamscs/splunktaucclib/data_collection/ta_config.py", line 60, in _load_task_configs self._divide_settings) File "/app/install/splunk/etc/apps/Splunk_TA_microsoft-cloudservices/bin/splunktamscs/splunktaucclib/data_collection/ta_config.py", line 80, in _generate_task_configs assert task_config.get(c.interval), "task config has no interval " \ AssertionError: task config has no interval field

Re: task config has no interval

deepashri_123 — Tue, 17 Apr 2018 09:37:08 GMT

Hey@davebo1896,

Have you created this stanza in inputs.conf?

[<input_stanza_name>]              
account = <value>
subscription_id = <value>
start_time = <value>
index = <value>
interval = <value>

is the interval parameter added?

Refer this doc:
http://docs.splunk.com/Documentation/AddOns/released/MSCloudServices/Configureinputs2
Let me know if this helps!!

Re: task config has no interval

davebo1896 — Tue, 17 Apr 2018 19:25:18 GMT

Thanks @deepashri_123,

I had assumed the GUI would add that as it created them. It had not. I manually updated each section with an interval, then restarted.

Unfortunately, still getting the error and not getting data.

Re: task config has no interval

jconger — Tue, 17 Apr 2018 22:34:59 GMT

Some of the configs are stored in the KV store. I've run into issues in the past if I try to create an input with the same name as a failed or previously deleted input. Try creating the input again with a unique name.

Re: task config has no interval

deepashri_123 — Wed, 18 Apr 2018 10:41:38 GMT

Is the error still the same or error is different?

Re: task config has no interval

davebo1896 — Thu, 26 Apr 2018 16:39:07 GMT

Same error

Re: task config has no interval

davebo1896 — Fri, 11 May 2018 14:05:54 GMT

It appears the problem is caused by the ordering of the configs
(and the UI does not put them in the correct order)

The stanza has to be configured in the order listed in the documentation:

 [<input_stanza_name>]              
 account = <value>
 subscription_id = <value>
 start_time = <value>
 index = <value>
 interval = <value>

Re: task config has no interval

rkantamaneni_sp — Thu, 25 Apr 2019 08:20:21 GMT

Yes, I discovered this today, it needs to match what you said, just like in this doc:

https://docs.splunk.com/Documentation/AddOns/released/MSCloudServices/Configureinputs2

Because this is a non-standard .conf file (mscs_azure_audit_inputs.conf), guessing it's processed by a script that's not being smart (i.e. automatically throwing into an object without checking the key-value pairs...). This is either a bug in the UI or in the script processing this .conf file.