All Apps and Add-ons

Does the Azure AD reporting add-on have a dependency on KV stores?

raoul
Path Finder

I have installed the addon but I cannot get data flowing.

If I search in _internal

 index="_internal" aad NOT raoul log_level=ERROR

I see the following:

5-15-2018 16:09:05.540 +0000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/TA-MS-AAD/bin/MS_AAD_signins.py" ERRORHTTP 503 Service Unavailable -- KV Store initialization failed. Please contact your system administrator.

0 Karma
1 Solution

guarisma
Contributor

Hello,

You will want to check your mongod.log for more details about this error, the most common error I've seen for this KV issue is an invalid SSL certificate.

regards,
Igor

View solution in original post

0 Karma

jconger
Splunk Employee
Splunk Employee

Yes, the add-on uses the KV Store to maintain a cursor check point. Each time the input runs and data is returned, the largest date/time seen during the poll is stored in the KV Store. The next time the add-on runs, the KV Store is queried to use the check point data as the start date/time for the query.

Check out this document for KV Store troubleshooting -> http://docs.splunk.com/Documentation/Splunk/latest/Admin/TroubleshootKVstore

0 Karma

guarisma
Contributor

Hello,

You will want to check your mongod.log for more details about this error, the most common error I've seen for this KV issue is an invalid SSL certificate.

regards,
Igor

0 Karma

raoul
Path Finder

Thanks, I see the following in the logs:

15/05/2018
14:25:47.912

***aborting after fassert() failure
host = splunk.example.com source = /opt/splunk/var/log/splunk/mongod.log sourcetype = mongod
15/05/2018
14:25:47.912

2018-05-15T14:25:47.912Z I -

host = splunk.liquidtelecom.com source = /opt/splunk/var/log/splunk/mongod.log sourcetype = mongod
15/05/2018
14:25:47.912

2018-05-15T14:25:47.912Z I - Fatal Assertion 28652
host = splunk.example.com source = /opt/splunk/var/log/splunk/mongod.log sourcetype = mongod
15/05/2018
14:25:47.912

2018-05-15T14:25:47.912Z F NETWORK The provided SSL certificate is expired or not yet valid.
host = splunk.example.com source = /opt/splunk/var/log/splunk/mongod.log sourcetype = mongod
15/05/2018
14:25:47.902

2018-05-15T14:25:47.902Z W CONTROL No SSL certificate validation can be performed since no CA file has been provided; please specify an sslCAFile parameter
host = splunk.example.com source = /opt/splunk/var/log/splunk/mongod.log sourcetype = mongod

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...