Does the Azure AD reporting add-on have a dependency on KV stores?

[raoul]

I have installed the addon but I cannot get data flowing.

If I search in _internal

 index="_internal" aad NOT raoul log_level=ERROR

I see the following:

5-15-2018 16:09:05.540 +0000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/TA-MS-AAD/bin/MS_AAD_signins.py" ERRORHTTP 503 Service Unavailable -- KV Store initialization failed. Please contact your system administrator.

[jconger]

Yes, the add-on uses the KV Store to maintain a cursor check point. Each time the input runs and data is returned, the largest date/time seen during the poll is stored in the KV Store. The next time the add-on runs, the KV Store is queried to use the check point data as the start date/time for the query.

Check out this document for KV Store troubleshooting -> http://docs.splunk.com/Documentation/Splunk/latest/Admin/TroubleshootKVstore

[guarisma · Accepted solution]

Hello,

You will want to check your mongod.log for more details about this error, the most common error I've seen for this KV issue is an invalid SSL certificate.

regards,
Igor

[raoul]

Thanks, I see the following in the logs:

15/05/2018
14:25:47.912

***aborting after fassert() failure
host = splunk.example.com source = /opt/splunk/var/log/splunk/mongod.log sourcetype = mongod
15/05/2018
14:25:47.912

2018-05-15T14:25:47.912Z I -

host = splunk.liquidtelecom.com source = /opt/splunk/var/log/splunk/mongod.log sourcetype = mongod
15/05/2018
14:25:47.912

2018-05-15T14:25:47.912Z I - Fatal Assertion 28652
host = splunk.example.com source = /opt/splunk/var/log/splunk/mongod.log sourcetype = mongod
15/05/2018
14:25:47.912

2018-05-15T14:25:47.912Z F NETWORK The provided SSL certificate is expired or not yet valid.
host = splunk.example.com source = /opt/splunk/var/log/splunk/mongod.log sourcetype = mongod
15/05/2018
14:25:47.902

2018-05-15T14:25:47.902Z W CONTROL No SSL certificate validation can be performed since no CA file has been provided; please specify an sslCAFile parameter
host = splunk.example.com source = /opt/splunk/var/log/splunk/mongod.log sourcetype = mongod