topic Microsoft Teams Add-on for Splunk Azure Subscription creation/update failing occasionally in Getting Data In

Microsoft Teams Add-on for Splunk Azure Subscription creation/update failing occasionally

ahennewig_sva — Fri, 05 Jul 2024 09:13:24 GMT

Hi,

we are currently experiencing reliability issues when using the Microsoft Teams Add-on for Splunk (https://splunkbase.splunk.com/app/4994😞

The renewal of the Azure Subscription, which should take place every 24h does not work sometimes and will not start again unless we create new inputs (subscription, webhook, call records). I did not find an error message regarding this in the logs. We build an alert for this problem. We use the TA from a HF in the DMZ. So it is possible that we missed a FW-rule for one of Microsofts Graph IPs. The problem does not appear in regular intervals.
Rarely the webhook will crash, requiring a restart of the Splunk process.

Has anyone experienced similar issue and has a solution to this problem?

Re: Microsoft Teams Add-on for Splunk Azure Subscription creation/update failing occasionally

marnall — Thu, 11 Jul 2024 19:55:33 GMT

For issue 1 I have also had this problem, where the subscription just stops working and does not auto-correct.

There is a lookup in the Splunk Enterprise instance which contains subscription information. You can make a scheduled search to overwrite this lookup, and then the app will make a new subscription and the logs should come in again.

Re: Microsoft Teams Add-on for Splunk Azure Subscription creation/update failing occasionally

bpelaia — Fri, 16 May 2025 17:46:14 GMT

Hi,

I got the same issue.

I wrote a small patch for the teams_subscription.py binary to solve it.

It is based on release 2.0.0.

The patch is attached as TA_MS_Teams-bruno.patch.txt.

To use it, just save the file as TA_MS_Teams-bruno.patch in the $SPLUNK_HOME/etc/apps directory and apply it using the following command in the TA_MS_Teams directory:

pelai@xps MINGW64 /d/src/TA_MS_Teams $ patch -p1 < ../TA_MS_Teams-bruno.patch.txt patching file bin/teams_subscription.py pelai@xps MINGW64 /d/src/TA_MS_Teams $

It is possible to revert the patch at anytime just using patch with the -R parameter.

I hope this can help.