All Apps and Add-ons

HTTP Request error: 400 Client Error: Bad Request in Microsoft Office 365 Reporting Add-on for Splunk

wiederkehrc
Explorer

Hi

I noticed that our   o365 message tracing logs stopped getting indexed using  Microsoft Office 365 Reporting Add-on for Splunk v 1.2.1

This a sample error message we got:

 

2020-07-20 13:19:32,756 ERROR pid=6727 tid=MainThread file=base_modinput.py:log_error:309 | HTTP Request error: 400 Client Error: Bad Request for url: https://reports.office365.com/ecp/reportingwebservice/reporting.svc/MessageTrace?$filter=StartDate%20eq%20datetime'2020-07-01T00:00:00Z'%20and%20EndDate%20eq%20datetime'2020-07-01T00:15:00Z'

 

I removed the ? in the "MessageTrace?$filter=StartDate"  part of the URL in this file input_module_ms_o365_message_trace.py

# Currently "$orderby=Received asc" does not work when retrieving messages with Skiptoken. Just drop "Received asc" then it works.
    #microsoft_trace_url = "https://reports.office365.com/ecp/reportingwebservice/reporting.svc/MessageTrace?$orderby=Received asc&$filter=StartDate eq datetime'%sZ' and EndDate eq datetime'%sZ'" % (start_date.isoformat(), end_date.isoformat())
# cwi remove ? from  filter
#microsoft_trace_url = "https://reports.office365.com/ecp/reportingwebservice/reporting.svc/MessageTrace?$filter=StartDate eq datetime'%sZ' and EndDate eq datetime'%sZ'" % (start_date.isoformat(), end_date.isoformat())

microsoft_trace_url = "https://reports.office365.com/ecp/reportingwebservice/reporting.svc/MessageTrace?filter=StartDate eq datetime'%sZ' and EndDate eq datetime'%sZ'" % (start_date.isoformat(), end_date.isoformat())
    messages = get_messages(helper, microsoft_trace_url, global_microsoft_office_365_username, global_microsoft_office_365_password)

 

The input is working on our installation now.

Labels (1)
0 Karma

mxg142
Explorer

Are you sure you removed the "?" in your URL?  Because in the bottom URL example it looks like you removed the "$"   ?  We are having the same issue only in the Splunk cloud IDM version so we are basically out of luck because this is not a Splunk supported add on. YAY!

0 Karma
Get Updates on the Splunk Community!

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...