All Apps and Add-ons

Error reading log from an azure storage account using TA-Azure



we are trying to read Windows Security Log (from different azure servers, gathered in a storage account) using the TA-Azure app.
Using the app version "122" we see duplicate events, it seems that the checkpoint value is not stored.
Instead, using the app version "123" we don't collect any events. Looking at the internal index we found the following error:
"Message from "python /opt/splunk/etc/apps/TA-Azure/bin/" - ERROR AzureDiagnostics: 372 - Error steaming date: 'int' object has no attribute 'lstrip'"
How do we solve the problems?



we noticed that in the code the timestamp (largest_partition_key) is initialized to 0. When the query return no entities (by the fact that we are analyzing a limited time range without any security event), the timestamp is not updated and remain equal to 0.

What we have done, as I workaround, is comment on the following part in the code:
[row 369 - save_checkpoint(checkpoint_dir, checkpoint_file_name, json.dumps(jsonMarker))], in order to avoid that a timestamp=0 will be saved as a checkpoint. The checkpoint is updated only when the query collects some events and return the last timestamp read.

0 Karma

New Member


Did you ever get a resolution to this? I am having the same issue and can't collect logs as expected.

0 Karma
Get Updates on the Splunk Community!

Dashboard Studio Challenge - Learn New Tricks, Showcase Your Skills, and Win Prizes!

Reimagine what you can do with your dashboards. Dashboard Studio is Splunk’s newest dashboard builder to ...

Introducing Edge Processor: Next Gen Data Transformation

We get it - not only can it take a lot of time, money and resources to get data into Splunk, but it also takes ...

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...