Bad Request for url: https://management.azure.com

[jaxjohnny2000]

| 400 Client Error: Bad Request for url: https://management.azure.com/subscriptions/c48f5cd5-7dd7-7e7a-b477-a3510abcdefg/providers/Microsoft....

sourcetype=ta_azure_billing_azure_billing-too_small

Any idea what permissions my client id is lacking? The permissions are not outlined in the details tab on: https://splunkbase.splunk.com/app/4109/#/details

[jaxjohnny2000]

Oh interesting. I Installed https://splunkbase.splunk.com/app/4109/, Microsoft Azure Billing Add-on for Splunk.

I did not have any panels or dashboards with this add-on.

My new issue is that the inputs panel will not load after the changes to the PY code. Your locations, line 83 and 86 were spot on. But the page just spins at "loading"...

Once this page load though, that search looks very useful.

[chrisyounger]

The dashboards are from this app: https://splunkbase.splunk.com/app/3564/ Azure template app.

[chrisyounger]

This is failing for us as well.

It looks like Microsoft has (silently?) changed the {billingPeriodName}. Previously it was the the format YYYYMMDD e.g. 20190301 but now it must be specified as YYYYMM-N e.g. 201903-1

Now I am not 100% sure if this is the correct fix as I am not an Azure person, but the following change worked for me and I can now retrieve data:

You can fix this by editing the modular input. A better option is to wait for Jason to update the Modular input properly, but in the meantime you could put this hack in place:

Edit TA-Azure-billing/bin/input_module_azure_billing.py

At about line 83 there should be a regular expression for calculating the billing period name
Change this from
billing_period_search = re.search('\/subscriptions\/([^\/]+)\/providers\/Microsoft\.Billing\/billingPeriods\/([^\/]+)$', billing_period_id, re.IGNORECASE)
to
billing_period_search = re.search('\/subscriptions\/([^\/]+)\/providers\/Microsoft\.Billing\/billingPeriods\/(\d{6})', billing_period_id, re.IGNORECASE)

then change line 86 from
billing_periods_returned.add(billing_period)
to
billing_periods_returned.add(billing_period + "-1")

The OOTB dashboards will also need a minor change becuase of this change to billingPeriodName.

I don't have time to investigate the root cause right now, but I think this change is OK for the short term.

Cheers,

[jaxjohnny2000]

Thank you for sharing this investigation. I'm making the changes. When I do the inputs panel freezes up. This must be the OOTB dashboard which needs a minor change. Do you remember what change you made?

[chrisyounger]

The top "Billing period" panel did not work. It was expecting the billing period to still be in the format YYYYMMDD. I fixed it by changing the search to be this:

`azure-billing-period` 
    [| makeresults 
    | eval id=$latestBillingPeriodId|s$
    | rex mode=sed field=id "s/01$/-1/"
    | return id]
| stats count by name properties.billingPeriodStartDate properties.billingPeriodEndDate 
| table name properties.billingPeriodStartDate properties.billingPeriodEndDate 
| rename name AS "Billing Period Name", properties.billingPeriodStartDate AS "Billing Period Start Date", properties.billingPeriodEndDate AS "Billing Period End Date"

All other panels were still working but I had to run the savedsearches first to populate the required lookup tables.