I have installed the addon but I cannot get data flowing.
If I search in _internal
index="_internal" aad NOT raoul log_level=ERROR
I see the following:
5-15-2018 16:09:05.540 +0000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/TA-MS-AAD/bin/MS_AAD_signins.py" ERRORHTTP 503 Service Unavailable -- KV Store initialization failed. Please contact your system administrator.
Hello,
You will want to check your mongod.log for more details about this error, the most common error I've seen for this KV issue is an invalid SSL certificate.
regards,
Igor
Yes, the add-on uses the KV Store to maintain a cursor check point. Each time the input runs and data is returned, the largest date/time seen during the poll is stored in the KV Store. The next time the add-on runs, the KV Store is queried to use the check point data as the start date/time for the query.
Check out this document for KV Store troubleshooting -> http://docs.splunk.com/Documentation/Splunk/latest/Admin/TroubleshootKVstore
Hello,
You will want to check your mongod.log for more details about this error, the most common error I've seen for this KV issue is an invalid SSL certificate.
regards,
Igor
Thanks, I see the following in the logs:
15/05/2018
14:25:47.912
***aborting after fassert() failure
host = splunk.example.com source = /opt/splunk/var/log/splunk/mongod.log sourcetype = mongod
15/05/2018
14:25:47.912
2018-05-15T14:25:47.912Z I -
host = splunk.liquidtelecom.com source = /opt/splunk/var/log/splunk/mongod.log sourcetype = mongod
15/05/2018
14:25:47.912
2018-05-15T14:25:47.912Z I - Fatal Assertion 28652
host = splunk.example.com source = /opt/splunk/var/log/splunk/mongod.log sourcetype = mongod
15/05/2018
14:25:47.912
2018-05-15T14:25:47.912Z F NETWORK The provided SSL certificate is expired or not yet valid.
host = splunk.example.com source = /opt/splunk/var/log/splunk/mongod.log sourcetype = mongod
15/05/2018
14:25:47.902
2018-05-15T14:25:47.902Z W CONTROL No SSL certificate validation can be performed since no CA file has been provided; please specify an sslCAFile parameter
host = splunk.example.com source = /opt/splunk/var/log/splunk/mongod.log sourcetype = mongod