All Apps and Add-ons

Data stops coming in after a while

patouellet
Path Finder

Hi,

We have an input setup to pull in data. It works but after a while it just stops and only a Splunk restart will get it going again.

In the log we can see this message:
2019-06-18 16:19:02,306 ERROR pid=91933 tid=MainThread file=base_modinput.py:log_error:307 | HTTP Request error: 500 Server Error: Internal Server Error for url: https://reports.office365.com/ecp/reportingwebservice/reporting.svc/MessageTrace?$filter=StartDate%2...;

Any ideas what could cause this?

0 Karma

DavidHourani
Super Champion

Hi @patouellet,

The error is point to something on the server side, not the Splunk side : error: 500 Server Error: Internal Server Error for url

You can test out your office 365 reporting web service using postman as follows: https://blogs.msdn.microsoft.com/emeamsgdev/2018/08/03/querying-the-office-365-management-apis-using...

Since data is coming in and suddenly stopping, this could indicate either a set limit or a certain loading breaking the service. Do you have any other error logs showing up in _internal ?

Cheers,
David

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...