Connection aborted error in Splunk's Microsoft log analytics add on application

[khyatim]

Hello All,

We have Microsoft log analytics add-on application installed into Splunk forwarder. With which we are ingesting all the Azure log analytics workspace logs into Splunk.

But, Since few days we have observed following pitfalls.

1. Delay in the azure logs ingestion into Splunk.

2. Duplicate entries of azure logs.

And on investigation, we identified the following connection errors.

Errors:

10-21-2021 13:44:42.789 +0000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/TA-ms-loganalytics/bin/log_analytics.py" raise ConnectionError(err, request=request)

10-21-2021 13:44:42.789 +0000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/TA-ms-loganalytics/bin/log_analytics.py" ConnectionError: ('Connection aborted.', BadStatusLine("''",))

Can anyone help us out with the following ask?

1. What is the cause behind this error?

2. How can we resolve this error/issue and get all the azure logs without delay?

[jwalzerpitt]

Any reply to the question or did you figure it out?

I'm seeing a different error starting today:

021-11-08 16:31:12,318 ERROR pid=4614 tid=MainThread file=base_modinput.py:log_error:309 | Traceback (most recent call last):

File "/opt/splunk/etc/apps/TA-MS-AAD/bin/ta_ms_aad/aob_py3/splunklib/binding.py", line 1262, in request
    raise HTTPError(response)
splunklib.binding.HTTPError: HTTP 500 Internal Server Error -- b'{"messages":[{"type":"ERROR","text":"Unexpected error \\"<class \'splunktaucclib.rest_handler.error.RestError\'>\\" from python handler: \\"REST Error [400]: Bad Request -- HTTP 400 Bad Request -- int() argument must be a string, a bytes-like object or a number, not \'NoneType\'\\".  See splunkd.log for more details."}]}'