After configuring Microsoft Azure Log analytics Add-on getting error "Failed to establish a new connection".

[sharma11031988]

Hello All,

We are trying to configure Add-on for client UAT environments but getting below error's.
Steps for integration was successfully tested in test environment while parameters for UAT have been reviewed too.
Can someone please suggest what could be root cause for same. Using Splunk Enterprise(Trial)

index=internal source="C:\Program Files\Splunk\var\log\splunk\splunkd.log"
10-21-2018 19:38:47.003 -0400 ERROR ExecProcessor - message from "python "C:\Program Files\Splunk\etc\apps\TA-ms-loganalytics\bin\log_analytics.py"" ERRORHTTPSConnectionPool(host='login.microsoftonline.com', port=443): Max retries exceeded with url: /{Tenant_ID}/oauth2/token?api-version=1.0 (Caused by NewConnectionError(': Failed to establish a new connection: [Errno 11001] getaddrinfo failed',))
Socket error from 127.0.0.1:1361 while accessing /en-US/splunkd/_raw/servicesNS/nobody/TA-ms-loganalytics/TA_ms_loganalytics_log_analytics: Winsock error 10053

index=_internal sourcetype="ta:ms:loganalytics:log"
2018-10-21 19:39:25,332 ERROR pid=51720 tid=MainThread file=base_modinput.py:log_error:307 | Get error when collecting events.
Traceback (most recent call last):
File "C:\Program Files\Splunk\etc\apps\TA-ms-loganalytics\bin\ta_ms_loganalytics\modinput_wrapper\base_modinput.py", line 127, in stream_events
self.collect_events(ew)
File "C:\Program Files\Splunk\etc\apps\TA-ms-loganalytics\bin\log_analytics.py", line 96, in collect_events
input_module.collect_events(self, ew)
File "C:\Program Files\Splunk\etc\apps\TA-ms-loganalytics\bin\input_module_log_analytics.py", line 49, in collect_events
token_response = context.acquire_token_with_client_credentials('https://api.loganalytics.io/', application_id, application_key)
File "C:\Program Files\Splunk\etc\apps\TA-ms-loganalytics\bin\adal\authentication_context.py", line 160, in acquire_token_with_client_credentials
return self._acquire_token(token_func)
File "C:\Program Files\Splunk\etc\apps\TA-ms-loganalytics\bin\adal\authentication_context.py", line 109, in _acquire_token
return token_func(self)
File "C:\Program Files\Splunk\etc\apps\TA-ms-loganalytics\bin\adal\authentication_context.py", line 158, in token_func
return token_request.get_token_with_client_credentials(client_secret)
File "C:\Program Files\Splunk\etc\apps\TA-ms-loganalytics\bin\adal\token_request.py", line 316, in get_token_with_client_credentials
token = self._oauth_get_token(oauth_parameters)
File "C:\Program Files\Splunk\etc\apps\TA-ms-loganalytics\bin\adal\token_request.py", line 113, in _oauth_get_token
return client.get_token(oauth_parameters)
File "C:\Program Files\Splunk\etc\apps\TA-ms-loganalytics\bin\adal\oauth2_client.py", line 262, in get_token
verify=self._call_context.get('verify_ssl', None))
File "C:\Program Files\Splunk\etc\apps\TA-ms-loganalytics\bin\ta_ms_loganalytics\requests\api.py", line 110, in post
return request('post', url, data=data, json=json, **kwargs)
File "C:\Program Files\Splunk\etc\apps\TA-ms-loganalytics\bin\ta_ms_loganalytics\requests\api.py", line 56, in request
return session.request(method=method, url=url, **kwargs)
File "C:\Program Files\Splunk\etc\apps\TA-ms-loganalytics\bin\ta_ms_loganalytics\requests\sessions.py", line 488, in request
resp = self.send(prep, **send_kwargs)
File "C:\Program Files\Splunk\etc\apps\TA-ms-loganalytics\bin\ta_ms_loganalytics\requests\sessions.py", line 609, in send
r = adapter.send(request, **kwargs)
File "C:\Program Files\Splunk\etc\apps\TA-ms-loganalytics\bin\ta_ms_loganalytics\requests\adapters.py", line 487, in send
raise ConnectionError(e, request=request)
ConnectionError: HTTPSConnectionPool(host='login.microsoftonline.com', port=443): Max retries exceeded
with url: /{Tenant ID}/oauth2/token?api-version=1.0 (Caused by
NewConnectionError(':
Failed to establish a new connection: [Errno 11001] getaddrinfo failed',))

Thanks,

[sharma11031988]

I did come across multiple blog stating that this issue is resolved post encrypting values like "=","/" or "+". However only thing worked for me was newly generated key which had // and + however without any encryption or any other change new key worked like.

Still wondering why add on would do so with some key.

Thanks,

[sharma11031988]

I did come across multiple blog stating that this issue is resolved post encrypting values like "=","/" or "+". However only thing worked for me was newly generated key which had // and + however without any encryption or any other change new key worked like.

Still wondering why add on would do so with some key.

Thanks,

[493669]

It seems your entered details for input creation is not correct like there can be special characters get inserted while copy pasting or space at begining or at end ...please try to enter below all details again and save the input.

Name: oms_test
 Interval: 60
 Index: main
 Resource Group: xxxx
 Workspace Name: xxxx
 Subscription ID: xxxxx
 Tenant ID: xxxx
 Application ID: xxxx
 Application ID: xxxx
 Log Analytics Query: search *
 Start Date: 22/10/2018 00:00:00
 Event Delay/ lag Time: 15