Hi,
We have an input setup to pull in data. It works but after a while it just stops and only a Splunk restart will get it going again.
In the log we can see this message:
2019-06-18 16:19:02,306 ERROR pid=91933 tid=MainThread file=base_modinput.py:log_error:307 | HTTP Request error: 500 Server Error: Internal Server Error for url: https://reports.office365.com/ecp/reportingwebservice/reporting.svc/MessageTrace?$filter=StartDate%2...;
Any ideas what could cause this?
Hi @patouellet,
The error is point to something on the server side, not the Splunk side : error: 500 Server Error: Internal Server Error for url
You can test out your office 365 reporting web service using postman as follows: https://blogs.msdn.microsoft.com/emeamsgdev/2018/08/03/querying-the-office-365-management-apis-using...
Since data is coming in and suddenly stopping, this could indicate either a set limit or a certain loading breaking the service. Do you have any other error logs showing up in _internal
?
Cheers,
David