topic Re: Issue with Microsoft Azure add-on for Splunk in All Apps and Add-ons

Why am I getting this error Issue with Microsoft Azure add-on for Splunk?

jwalzerpitt — Wed, 25 May 2022 18:23:20 GMT

I have been using Microsoft Azure add-on for Splunk to ingest Azure sign in logs for over a year and today I see the following error:

021-11-08 16:31:12,318 ERROR pid=4614 tid=MainThread file=base_modinput.py:log_error:309 | Traceback (most recent call last): File "/opt/splunk/etc/apps/TA-MS-AAD/bin/ta_ms_aad/aob_py3/splunklib/binding.py", line 1262, in request raise HTTPError(response) splunklib.binding.HTTPError: HTTP 500 Internal Server Error -- b'{"messages":[{"type":"ERROR","text":"Unexpected error \\"<class \'splunktaucclib.rest_handler.error.RestError\'>\\" from python handler: \\"REST Error [400]: Bad Request -- HTTP 400 Bad Request -- int() argument must be a string, a bytes-like object or a number, not \'NoneType\'\\". See splunkd.log for more details."}]}'

Has anyone else experiencing this issue?

Re: Issue with Microsoft Azure add-on for Splunk

wstarowicz — Tue, 09 Nov 2021 08:45:52 GMT

Same for me...

2021-11-09 09:34:44,317 ERROR pid=8468 tid=MainThread file=base_modinput.py:log_error:309 | _Splunk_ Unable to obtain access token

Re: Issue with Microsoft Azure add-on for Splunk

wstarowicz — Tue, 09 Nov 2021 10:36:04 GMT

I managed to fix it. I edited credentials in addon configuration and saved it. The same for inputs - edit & save. Started to work.

Re: Issue with Microsoft Azure add-on for Splunk

jwalzerpitt — Tue, 09 Nov 2021 11:38:38 GMT

I recreated the input on the add-on and recreated the app registration in Azure and still not working for me

Re: Issue with Microsoft Azure add-on for Splunk

gaurav_maniar — Fri, 03 Dec 2021 11:35:59 GMT

Hi,

Have you guys found any fix for this issue??

Thanks.

Re: Issue with Microsoft Azure add-on for Splunk

SinghK — Fri, 03 Dec 2021 12:18:59 GMT

All these addons write to specific logfile can you search for more specific error in there. Mostly these addons have webhooks that they use to get data from azure application and if this one is also using a webhook is that webhook publicly available. and when the data is fetched it writes to a check point file somewhere and that gets corrupt too.

Re: Issue with Microsoft Azure add-on for Splunk

yamamotokentis — Mon, 07 Mar 2022 10:43:17 GMT

Hi,

I have been using Microsoft Azure add-on for Splunk for a year.
I also saw following message,

"ERROR pid=9511 tid=MainThread file=base_modinput.py:log_error:309 | _Splunk_ Unable to obtain access token"

And create new secret id and value on Azure AD, and apply it ot the splunk app.
However I could not fix the issue.

Has anyone else experiencing this issue?

Re: Issue with Microsoft Azure add-on for Splunk

pagillar — Tue, 24 May 2022 20:16:20 GMT

was this issue fixed?

Re: Issue with Microsoft Azure add-on for Splunk

yamamotokentis — Wed, 25 May 2022 01:50:02 GMT

Yes, fixed. However the cause is unknown..

Re: Issue with Microsoft Azure add-on for Splunk

pagillar — Wed, 25 May 2022 13:23:34 GMT

what did you do to fix the issue?

Re: Issue with Microsoft Azure add-on for Splunk

pavithra — Fri, 26 Jul 2024 03:35:13 GMT

please post the solution