Splunk Add-on for Google Workspace giving 400 Error

cbyrd — Tue, 04 Mar 2025 20:39:42 GMT

We are using the Splunk Add-On for GWS Version3.0.3 for Splunk Cloud and receiving this error when attempting to pull in the (user) identities portion. I have tried both 'admin_view' and 'domain_public' in the Inputs config with same error. All other functions are working fine. I need to bring in this sourcetype "gws_users_identity" to populate our identities lookup. Has anyone else encountered this? Maybe you found a "fix"?

ERROR pid=<redacted> tid=MainThread file=log.py:log_exception:351 | exc_l="User Identity Error" Exception raised while ingesting data for users: <HttpError 400 when requesting https[:]//admin.googleapis.com/admin/directory/v1/users?customer=<redacted>&orderBy=email&maxResults=500&viewType=domain_public&alt=json returned "Bad Request". Details: "[{'message': 'Bad Request', 'domain': 'global', 'reason': 'badRequest'}]">. Traceback (most recent call last): File "/opt/splunk/etc/apps/Splunk_TA_Google_Workspace/bin/gws_user_identity.py", line 139, in stream_events service.users()

Re: Splunk Add-on for Google Workspace giving 400 Error

livehybrid — Tue, 04 Mar 2025 22:07:59 GMT

Hi @cbyrd

Given that the 400 error is coming from the Google API, I'd start off by checking for config issues on the Google side.

Check API Permissions:
- Ensure that the Google Workspace service account you're using has the necessary permissions to access user data. The service account should have the "Directory API" enabled and the appropriate scopes granted, such as https://www.googleapis.com/auth/admin.directory.user.readonly.
Verify API Scopes:
- Double-check that the OAuth 2.0 scopes configured for the service account include the necessary permissions. You might need to add or adjust scopes in the Google Cloud Console.
Customer ID:
- Ensure that the customer parameter in the API request is correct. It should be the unique ID of your Google Workspace account. You can find this ID in the Admin console under Account settings.
View Type:
- The viewType parameter can be either admin_view or domain_public. Make sure that the view type you are using is appropriate for your use case and that the account has the necessary permissions to access the data with that view type.
API Quotas and Limits:
- Check if you are hitting any API quotas or limits. Google APIs have usage limits, and exceeding them can result in errors.

Please let me know how you get on and consider adding karma to this or any other answer if it has helped.
Regards

Will

topic Re: Splunk Add-on for Google Workspace giving 400 Error in Getting Data In

Splunk Add-on for Google Workspace giving 400 Error

Re: Splunk Add-on for Google Workspace giving 400 Error