All Apps and Add-ons

Incorrect padding error when Splunk Cloud is getting input from an Azure table

sujitdmello
New Member

My Azure table is not getting sucked into Splunk.

I see the following error every 5 minutes (that's the interval that I setup) :

2017-02-18 13:29:05,991 +0000 log_level=ERROR, pid=4753, tid=Thread-163, file=mscs_storage_dispatcher.py, func_name=dispatch_storage_list, code_line_no=92 | [stanza_name="WADTest Application Logs" account_name="wadtest" table_list="WAD*"] Exception@_dispatch_tables() ,error_message=TypeError: Incorrect padding
Traceback (most recent call last):
File "/opt/splunk/etc/apps/Splunk_TA_microsoft-cloudservices/bin/splunk_ta_microsoft_cloudservices/mscs_storage_dispatcher.py", line 86, in _dispatch_storage_list
self._do_dispatch()
File "/opt/splunk/etc/apps/Splunk_TA_microsoft-cloudservices/bin/splunk_ta_microsoft_cloudservices/mscs_storage_dispatcher.py", line 96, in _do_dispatch
self._dispatch_tasks(patterns)
File "/opt/splunk/etc/apps/Splunk_TA_microsoft-cloudservices/bin/splunk_ta_microsoft_cloudservices/mscs_storage_dispatcher.py", line 119, in _dispatch_tasks
next_marker, patterns)
File "/opt/splunk/etc/apps/Splunk_TA_microsoft-cloudservices/bin/splunk_ta_microsoft_cloudservices/mscs_storage_table_dispatcher.py", line 54, in _get_storage_info_list
tables = table_service.list_tables(marker=marker)
File "/opt/splunk/etc/apps/Splunk_TA_microsoft-cloudservices/bin/splunk_ta_microsoft_cloudservices/azure/storage/table/tableservice.py", line 419, in list_tables
resp = self._list_tables(**kwargs)
File "/opt/splunk/etc/apps/Splunk_TA_microsoft-cloudservices/bin/splunk_ta_microsoft_cloudservices/azure/storage/table/tableservice.py", line 456, in _list_tables
response = self._perform_request(request)
File "/opt/splunk/etc/apps/Splunk_TA_microsoft-cloudservices/bin/splunk_ta_microsoft_cloudservices/azure/storage/storageclient.py", line 186, in _perform_request
raise AzureException('{}: {}'.format(ex.
class.name_, ex.args[0]))
AzureException: TypeError: Incorrect padding
Collapse
host = prd-p-px33jhshxm8c
source = /opt/splunk/var/log/splunk/splunk_ta_microsoft-cloudservices_storage_table_WADTest_Application_Logs_B64_V0FEVGVzdCBBcHBsaWNhdGlvbiBMb2dz.log
sourcetype = mscs:storage:table:log

0 Karma

maciep
Champion

Old thread, but we had the same issue. Support suggested that it could be related to invalid characters in the base64 encoding. Our Azure user noticed a plus sign (+) in the access key for the azure account, and thought maybe that was the reason based on this article

https://www.8bitavenue.com/2018/02/base64-encoding-in-python/

he created a new access key with no invalid characters and it is working now. I'm not positive that was the problem/solution, but thought I'd at least share it out here as an option for people to try.

0 Karma

paimonsoror
Builder

Old thread, but im having the same issue.

0 Karma
Get Updates on the Splunk Community!

There's No Place Like Chrome and the Splunk Platform

Watch On DemandMalware. Risky Extensions. Data Exfiltration. End-users are increasingly reliant on browsers to ...

The Great Resilience Quest: 5th Leaderboard Update

The fifth leaderboard update for The Great Resilience Quest is out >> 🏆 Check out the ...

Devesh Logendran, Splunk, and the Singapore Cyber Conquest

At this year’s Splunk University, I had the privilege of chatting with Devesh Logendran, one of the winners in ...