Google Apps for Splunk: Gsuite HttpError

[dmenon84]

We are seeing the following error on Splunk when we configured the Gsuite add-on. Is there some json that I need to change on any of the .py files?

"log_level": "ERROR", "modular_input_consumption_time": "Fri, 24 Aug 2018 14:35:43 +0000", "timestamp": "Fri, 24 Aug 2018 14:35:43 +0000", "errors": [{"input_name": "ga://domain.edu_gsuite", "exception_arguments": "error=http_error message='<HttpError 400 when requesting https://www.googleapis.com/admin/reports/v1/usage/users/all/dates/2018-08-23?alt=json returned \"Data for dates later than 2018-08-22 is not yet available. Please check back later\">'", "filename": "GoogleAppsForSplunkModularInput.py", "msg": "error=http_error message='<HttpError 400 when requesting https://www.googleapis.com/admin/reports/v1/usage/users/all/dates/2018-08-23?alt=json returned \"Data for dates later than 2018-08-22 is not yet available. Please check back later\">'", "exception_type": "unicode", "line": 324}]}

[alacercogitatus]

This is a known issue. You can safely ignore this error. Google takes its sweet time compiling the data, so to make sure we absolutely do not miss data, we make a request for data that may or may not exist at the time of the call. It fails with that error, but on success, we index it and store the date so as not to pull it again. If the input doesn't run for a few days, it'll be sure to pick up the extra missing data.

[jboiselle]

Hey alacercogitatus,

I'm having a similar issue. I've left the app installed for about 2-3 weeks now, and confirmed that it is pulling in some data. Specifically, it has no issues pulling in event data. However, I have noticed that it still hasn't pulled in any usage data. I receive the same error as dmenon84 for the past 2 days every day -- and not once has it been successful in pulling in data.

The input is currently configured to pull down user and customer usage data on a daily interval. I have the extra configuration set to {"historical_days":180}, but adjusting this hasn't seemed to make a difference. It seems like the input should check for more than 2 days ago, but I'm not sure. Any advice?

[alacercogitatus]

The historical days only works on first time the input runs, after that it is taken on checkpoints. You can join us on slack (splk.it/slack) and there is a #gsuite_app Channel for more direct questioning and responses. I'll check in v1.3.0 and see if I'm pulling data for usage. Thanks!

[jbethmont]

I'm facing the exact same issue. Have you been able to solve it yet ?