All Apps and Add-ons

Connection aborted error in Splunk's Microsoft log analytics add on application

khyatim
Engager

Hello All,

We have Microsoft log analytics add-on application installed into Splunk forwarder. With which we are ingesting all the Azure log analytics workspace logs into Splunk.

But, Since few days we have observed following pitfalls.

1. Delay in the azure logs ingestion into Splunk.

2. Duplicate entries of azure logs.

And on investigation, we identified the following connection errors.

Errors:

10-21-2021 13:44:42.789 +0000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/TA-ms-loganalytics/bin/log_analytics.py" raise ConnectionError(err, request=request)

10-21-2021 13:44:42.789 +0000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/TA-ms-loganalytics/bin/log_analytics.py" ConnectionError: ('Connection aborted.', BadStatusLine("''",))

splunk log analytics error.PNG

Can anyone help us out with the following ask?

1. What is the cause behind this error?

2. How can we resolve this error/issue and get all the azure logs without delay?

Labels (3)

jwalzerpitt
Influencer

Any reply to the question or did you figure it out?

I'm seeing a different error starting today:

021-11-08 16:31:12,318 ERROR pid=4614 tid=MainThread file=base_modinput.py:log_error:309 | Traceback (most recent call last):

File "/opt/splunk/etc/apps/TA-MS-AAD/bin/ta_ms_aad/aob_py3/splunklib/binding.py", line 1262, in request
    raise HTTPError(response)
splunklib.binding.HTTPError: HTTP 500 Internal Server Error -- b'{"messages":[{"type":"ERROR","text":"Unexpected error \\"<class \'splunktaucclib.rest_handler.error.RestError\'>\\" from python handler: \\"REST Error [400]: Bad Request -- HTTP 400 Bad Request -- int() argument must be a string, a bytes-like object or a number, not \'NoneType\'\\".  See splunkd.log for more details."}]}'
Get Updates on the Splunk Community!

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...

The Visibility Gap: Hybrid Networks and IT Services

The most forward thinking enterprises among us see their network as much more than infrastructure – it's their ...

Get Operational Insights Quickly with Natural Language on the Splunk Platform

In today’s fast-paced digital world, turning data into actionable insights is essential for success. With ...