https://community.splunk.com/t5/Getting-Data-In/What-is-this-Add-on-for-Microsoft-Office-365-error/m-p/590309#M103430 <P>I am trying to configure a new input in the Splunk Add-on for Microsoft Office 365.&nbsp; I am receiving errors which I have not been able to fix.&nbsp; Assistance would be greatly appreciated.</P> <UL> <LI>Input Name: AuditLogs.Signins</LI> <LI>Input Type: Graph API</LI> </UL> <P>&nbsp;</P> <LI-CODE lang="markup">2022-03-22 12:24:38,005 level=ERROR pid=3126388 tid=MainThread logger=splunk_ta_o365.modinputs.graph_api pos=utils.py:wrapper:72 | datainput=b'AuditLogsSignins' start_time=1647966277 | message="Data input was interrupted by an unhandled exception." Traceback (most recent call last): File "/opt/splunk/etc/apps/splunk_ta_o365/bin/splunksdc/utils.py", line 70, in wrapper return func(*args, **kwargs) File "/opt/splunk/etc/apps/splunk_ta_o365/bin/splunk_ta_o365/modinputs/graph_api.py", line 235, in run 2022-03-22 12:24:38,004 level=ERROR pid=3126388 tid=MainThread logger=splunk_ta_o365.modinputs.graph_api pos=graph_api.py:run:118 | datainput=b'AuditLogsSignins' start_time=1647966277 | message="Error retrieving Cloud Application Security messages." exception='NoneType' object is not iterable 2022-03-22 12:24:37,999 level=ERROR pid=3126388 tid=MainThread logger=splunk_ta_o365.common.portal pos=portal.py:get:476 | datainput=b'AuditLogsSignins' start_time=1647966277 | message="There was an exception processing the response from Microsoft Graph API" exception=401:{"error":{"code":"InvalidAuthenticationToken","message":"Access token validation failure. Invalid audience.","innerError":{"date":"2022-03-22T16:24:37","request-id":"","client-request-id":""}}} Traceback (most recent call last): File "/opt/splunk/etc/apps/splunk_ta_o365/bin/splunk_ta_o365/common/portal.py", line 467, in get raise O365PortalError(response) splunk_ta_o365.common.portal.O365PortalError: 401:{"error":{"code":"InvalidAuthenticationToken","message":"Access token validation failure. Invalid audience.","innerError":{"date":"2022-03-22T16:24:37","request-id":"","client-request-id":""}}} 2022-03-22 12:24:37,814 level=INFO pid=3126388 tid=MainThread logger=splunk_ta_o365.common.portal pos=portal.py:get:462 | datainput=b'AuditLogsSignins' start_time=1647966277 | message="Calling Microsoft Graph API." url=b'https://graph.microsoft.us/v1.0/auditLogs/signIns' params=None</LI-CODE> <P>&nbsp;</P> Wed, 23 Mar 2022 03:58:00 GMT adamblock2 2022-03-23T03:58:00Z https://community.splunk.com/t5/Getting-Data-In/What-is-this-Add-on-for-Microsoft-Office-365-error/m-p/590309#M103430 <P>I am trying to configure a new input in the Splunk Add-on for Microsoft Office 365.&nbsp; I am receiving errors which I have not been able to fix.&nbsp; Assistance would be greatly appreciated.</P> <UL> <LI>Input Name: AuditLogs.Signins</LI> <LI>Input Type: Graph API</LI> </UL> <P>&nbsp;</P> <LI-CODE lang="markup">2022-03-22 12:24:38,005 level=ERROR pid=3126388 tid=MainThread logger=splunk_ta_o365.modinputs.graph_api pos=utils.py:wrapper:72 | datainput=b'AuditLogsSignins' start_time=1647966277 | message="Data input was interrupted by an unhandled exception." Traceback (most recent call last): File "/opt/splunk/etc/apps/splunk_ta_o365/bin/splunksdc/utils.py", line 70, in wrapper return func(*args, **kwargs) File "/opt/splunk/etc/apps/splunk_ta_o365/bin/splunk_ta_o365/modinputs/graph_api.py", line 235, in run 2022-03-22 12:24:38,004 level=ERROR pid=3126388 tid=MainThread logger=splunk_ta_o365.modinputs.graph_api pos=graph_api.py:run:118 | datainput=b'AuditLogsSignins' start_time=1647966277 | message="Error retrieving Cloud Application Security messages." exception='NoneType' object is not iterable 2022-03-22 12:24:37,999 level=ERROR pid=3126388 tid=MainThread logger=splunk_ta_o365.common.portal pos=portal.py:get:476 | datainput=b'AuditLogsSignins' start_time=1647966277 | message="There was an exception processing the response from Microsoft Graph API" exception=401:{"error":{"code":"InvalidAuthenticationToken","message":"Access token validation failure. Invalid audience.","innerError":{"date":"2022-03-22T16:24:37","request-id":"","client-request-id":""}}} Traceback (most recent call last): File "/opt/splunk/etc/apps/splunk_ta_o365/bin/splunk_ta_o365/common/portal.py", line 467, in get raise O365PortalError(response) splunk_ta_o365.common.portal.O365PortalError: 401:{"error":{"code":"InvalidAuthenticationToken","message":"Access token validation failure. Invalid audience.","innerError":{"date":"2022-03-22T16:24:37","request-id":"","client-request-id":""}}} 2022-03-22 12:24:37,814 level=INFO pid=3126388 tid=MainThread logger=splunk_ta_o365.common.portal pos=portal.py:get:462 | datainput=b'AuditLogsSignins' start_time=1647966277 | message="Calling Microsoft Graph API." url=b'https://graph.microsoft.us/v1.0/auditLogs/signIns' params=None</LI-CODE> <P>&nbsp;</P> Wed, 23 Mar 2022 03:58:00 GMT https://community.splunk.com/t5/Getting-Data-In/What-is-this-Add-on-for-Microsoft-Office-365-error/m-p/590309#M103430 adamblock2 2022-03-23T03:58:00Z