All Apps and Add-ons

Getting “Invalid client secret is provided” error while setting up Splunk with Azure Event Hub

New Member

I am getting the following error while configuring Splunk with Azure Event Hub.

2021-04-23 10:12:17,141 level=WARNING pid=xxxxxxx tid=Thread-2 logger=azure.eventhub._eventprocessor.event_processor | EventProcessor instance '2ea6353e-ee45-4a4e-b173-5f82ae79707c' of eventhub 'insights-activity-logs' consumer group '$Default'. An error occurred while load-balancing and claiming ownership. The exception is EventHubError("Unexpected response '{'error': 'invalid_client', 'error_description': 'AADSTS7000215: Invalid client secret is provided.\r\nTrace ID:xxxxxxx-c913-420f-8dfb-5169faed3800\r\nCorrelation ID: xxxxxxxx-81b2-4436-9d25-13e38ec15d9d\r\nTimestamp: 2021-04-23 02:12:10Z', 'error_codes': [7000215], 'timestamp': '2021-04-23 02:12:10Z', 'trace_id': 'xxxxxxxxx-c913-420f-8dfb-5169faed3800', 'correlation_id': 'xxxxxxxx-81b2-4436-9d25-13e38ec15d9d', 'error_uri': ''}'\nUnexpected response '{'error': 'invalid_client', 'error_description': 'AADSTS7000215: Invalid client secret is provided.\r\nTrace ID: xxxxxxx-c913-420f-8dfb-5169faed3800\r\nCorrelation ID: xxxxxxx-81b2-4436-9d25-13e38ec15d9d\r\nTimestamp: 2021-04-23 02:12:10Z', 'error_codes': [7000215], 'timestamp': '2021-04-23 02:12:10Z', 'trace_id': 'xxxxxxxxx-c913-420f-8dfb-5169faed3800', 'correlation_id': 'xxxxxxxxxx-81b2-4436-9d25-13e38ec15d9d', 'error_uri': ''}'"). Retrying after 10.408012031827356 seconds


I am referring to the following tutorials:

From my understanding, it is that we will have to generate a Azure AD application and set its permission for resource management and here, I am making use of it to enable Splunk to access the activity logs to my Event Hub. I have done setting up an AD application and added the role assignment to the AD application, after that, generated a client secret as mentioned in the tutorial. I am subscribing to Azure for Student, will this be the cause of getting this error as I have limited privileges?

Labels (1)
0 Karma

Splunk Employee
Splunk Employee

Version 4.1.3 May 13, 2021
* Fix for customers seeing AADSTS7000215: Invalid client secret is provided for EventHubs Inputs

In the data inputs for the app:
Make sure you're using the FQDN

On the Azure side:
Make sure the role is eventhub data receiver on Azure configuration side.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!