topic Re: Splunk Add-on for Microsoft Azure: Is there a reason Splunk keeps retrieving the same data from Azure? in All Apps and Add-ons

Splunk Add-on for Microsoft Azure: Is there a reason Splunk keeps retrieving the same data from Azure?

mhazz19087 — Tue, 10 May 2016 21:09:30 GMT

I currently have the Splunk Add-on for Microsoft Azure for Splunk installed, but have noticed that each time it polls, it only retrieves the same set of events repeatedly and has not retrieved any new events since its implementation. I followed the directions in the PDF that comes with the add-on. Any advice would be greatly appreciated!

Thank you!

Re: Splunk Add-on for Microsoft Azure: Is there a reason Splunk keeps retrieving the same data from Azure?

jconger — Tue, 10 May 2016 21:57:25 GMT

Which input are you using? Also, try running the following search:

index=_internal sourcetype=splunkd Azure*

Re: Splunk Add-on for Microsoft Azure: Is there a reason Splunk keeps retrieving the same data from Azure?

mhazz19087 — Wed, 11 May 2016 14:53:13 GMT

I am using the Azure Audit input.

When I run that search I get the following error:

ERROR ExecProcessor - message from "python "C:\Program Files\Splunk\etc\apps\TA-Azure\bin\AzureAudit.py"" 2016-05-11 10:49:00,559 ERROR AzureAudit:410 - Error steaming data: [Error 183] Cannot create a file when that file already exists

There are also other licensing and metric entries too and they are all the same.

Re: Splunk Add-on for Microsoft Azure: Is there a reason Splunk keeps retrieving the same data from Azure?

mhazz19087 — Wed, 11 May 2016 14:53:29 GMT

And thank you for your time!

Re: Splunk Add-on for Microsoft Azure: Is there a reason Splunk keeps retrieving the same data from Azure?

giorgio_adami_m — Wed, 11 May 2016 15:25:44 GMT

Take a look!
https://answers.splunk.com/answers/396835/splunk-add-on-for-microsoft-azure-azurewebsitediag.html

Re: Splunk Add-on for Microsoft Azure: Is there a reason Splunk keeps retrieving the same data from Azure?

danieltodorov — Thu, 12 May 2016 09:49:18 GMT

Hello i hit the same issue. The problem it appears because they use os.rename to save information in file, about what is the latest collected data, but in Windows this fails after the first collection. It fails because in windows os.rename can’t save the file if the destination exist.

You can check the Python Docs : https://docs.python.org/2/library/os.html

For a workaround i changed the Python script to check if file exist before the rename and if it's existing, the script delete it.

Re: Splunk Add-on for Microsoft Azure: Is there a reason Splunk keeps retrieving the same data from Azure?

mhazz19087 — Thu, 12 May 2016 15:53:34 GMT

I see what you're referencing, but I cannot locate the file that "already exists". I would prefer not to edit the script if necessary, especially as this isn't the exact same scenario. If I could locate this file I could rename it so that it could be recreated.