Data stops coming in after a while

[patouellet]

Hi,

We have an input setup to pull in data. It works but after a while it just stops and only a Splunk restart will get it going again.

In the log we can see this message:
2019-06-18 16:19:02,306 ERROR pid=91933 tid=MainThread file=base_modinput.py:log_error:307 | HTTP Request error: 500 Server Error: Internal Server Error for url: https://reports.office365.com/ecp/reportingwebservice/reporting.svc/MessageTrace?$filter=StartDate%2...;

Any ideas what could cause this?

[DavidHourani]

Hi @patouellet,

The error is point to something on the server side, not the Splunk side : error: 500 Server Error: Internal Server Error for url

You can test out your office 365 reporting web service using postman as follows: https://blogs.msdn.microsoft.com/emeamsgdev/2018/08/03/querying-the-office-365-management-apis-using...

Since data is coming in and suddenly stopping, this could indicate either a set limit or a certain loading breaking the service. Do you have any other error logs showing up in _internal ?

Cheers,
David