topic Re: Microsoft Azure Active Directory Add-on for Splunk: Customized key cannot be found in All Apps and Add-ons

Microsoft Azure Active Directory Add-on for Splunk: Customized key cannot be found

wstarowicz — Fri, 21 Jun 2019 08:48:56 GMT

Hi, for a few days I haven't gotten any logs.
After enabling debug, I see something like " Customized key cannot be found".
What does it mean?

Re: Microsoft Azure Active Directory Add-on for Splunk: Customized key cannot be found

DavidHourani — Fri, 21 Jun 2019 09:39:31 GMT

Hi @wstarowicz, what errors do you have exactly in _internal regarding this issue, could you give us some outputs here ?

Re: Microsoft Azure Active Directory Add-on for Splunk: Customized key cannot be found

wstarowicz — Fri, 21 Jun 2019 09:56:33 GMT

It's a bit strange. Earlier I had 429 (since few days). These started to appear (as INFO) after few disabling/enabling of the input. Now it started working (logs are downloaded). So this is rather question now what does it mean.

2019-06-21 11:52:40,409 DEBUG pid=11844 tid=MainThread file=connectionpool.py:_new_conn:809 | Starting new HTTPS connection (1): login.microsoftonline.com 2019-06-21 11:52:40,690 DEBUG pid=11844 tid=MainThread file=connectionpool.py:_make_request:400 | https://login.microsoftonline.com:443 "POST /tenant_id/oauth2/v2.0/token HTTP/1.1" 200 1516 2019-06-21 11:52:40,693 DEBUG pid=11844 tid=MainThread file=base_modinput.py:log_debug:286 | Sign-in URL used: https://graph.microsoft.com/beta/auditLogs/signIns?$orderby=createdDateTime&$filter=createdDateTime+ge+2019-06-21T09:43:58.2944434Z 2019-06-21 11:52:40,693 INFO pid=11844 tid=MainThread file=setup_util.py:log_info:114 | Customized key can not be found

Re: Microsoft Azure Active Directory Add-on for Splunk: Customized key cannot be found

DavidHourani — Fri, 21 Jun 2019 10:36:27 GMT

Which Splunk version are you using ? Maybe there was an incompatibility. Also did you restart Splunk after installing the ad-on ?

Re: Microsoft Azure Active Directory Add-on for Splunk: Customized key cannot be found

wstarowicz — Fri, 21 Jun 2019 10:39:32 GMT

Hi, yes I did. I'm running version 7.2.4.

Re: Microsoft Azure Active Directory Add-on for Splunk: Customized key cannot be found

DavidHourani — Fri, 21 Jun 2019 10:48:47 GMT

That should be okay, it's supported : Splunk Versions: 7.3, 7.2, 7.1, 7.0, 6.6. Should be some bug that got flushed with the enable-disable.

Re: Microsoft Azure Active Directory Add-on for Splunk: Customized key cannot be found

brianbye — Thu, 01 Aug 2019 11:25:52 GMT

Im having the same issue. Anyone figure out a permanent solution?

Re: Microsoft Azure Active Directory Add-on for Splunk: Customized key cannot be found

ylucena — Tue, 10 Sep 2019 17:40:02 GMT

I am having the same problem! Did you guys figured that out?

Re: Microsoft Azure Active Directory Add-on for Splunk: Customized key cannot be found

jwalzerpitt — Thu, 19 Sep 2019 14:34:58 GMT

+1 as also having the issue

Any idea as to why the issue and if a solution exists?

Re: Microsoft Azure Active Directory Add-on for Splunk: Customized key cannot be found

schelms — Wed, 25 Sep 2019 20:13:50 GMT

I started receiving this error recently. It seems that when I have 2 or more inputs (either Signins, Audit, or Users) then I get this error. However, if I delete all but a single input then it works. So temporarily I can only have one working input.

I think the issue may have to do with the rotation of the Auth token when making the API call but that is just my guess.

Re: Microsoft Azure Active Directory Add-on for Splunk: Customized key cannot be found

jaxjohnny2000 — Wed, 30 Sep 2020 02:29:05 GMT

Same issue here. My Client Certificate expired. I created a new one. Then may other errors, but this is the most pervasive.

tid=MainThread file=setup_util.py:log_info:114 | Customized key can not be found

Re: Microsoft Azure Active Directory Add-on for Splunk: Customized key cannot be found

jaxjohnny2000 — Fri, 04 Oct 2019 20:58:20 GMT

maybe. I have the same issue after my initial key expired. It does not like the second one.

Re: Microsoft Azure Active Directory Add-on for Splunk: Customized key cannot be found

jaxjohnny2000 — Fri, 11 Oct 2019 20:03:39 GMT

Problem no longer exists after upgrading to 2.0.0 for me.