All Apps and Add-ons

Invalid Key in Stanza for TA-MS-AAD

Nossel
Observer

Hi,

I recently took over our instance from a colleague that left and I am stuck on this error whenever I reboot the Splunk server where the TA is installed:

Invalid key in stanza [MS_AAD_signins://AzureADSignins] in /data/splunk/etc/apps/TA-MS-AAD/local/inputs.conf, line 4: max_records (value: XX).
Invalid key in stanza [MS_AAD_signins://AzureADSignins] in /data/splunk/etc/apps/TA-MS-AAD/local/inputs.conf, line 6: tenant_domain (value: XXXXXX).
Invalid key in stanza [MS_AAD_signins://AzureADSignins] in /data/splunk/etc/apps/TA-MS-AAD/local/inputs.conf, line 7: client_id (value: XXXXXXX).
Invalid key in stanza [MS_AAD_signins://AzureADSignins] in /data/splunk/etc/apps/TA-MS-AAD/local/inputs.conf, line 8: client_secret (value: XXXXXXX).
Invalid key in stanza [MS_AAD_audit://AzureADAudit] in /data/splunk/etc/apps/TA-MS-AAD/local/inputs.conf, line 18: max_records (value: XX).
Invalid key in stanza [MS_AAD_audit://AzureADAudit] in /data/splunk/etc/apps/TA-MS-AAD/local/inputs.conf, line 20: tenant_domain (value: XXXXXXX).
Invalid key in stanza [MS_AAD_audit://AzureADAudit] in /data/splunk/etc/apps/TA-MS-AAD/local/inputs.conf, line 21: client_id (value: XXXXXXXX).
Invalid key in stanza [MS_AAD_audit://AzureADAudit] in /data/splunk/etc/apps/TA-MS-AAD/local/inputs.conf, line 22: client_secret (value: XXXX).
Invalid key in stanza [additional_parameters] in /data/splunk/etc/apps/TA-MS-AAD/local/ta_ms_aad_settings.conf, line 2: client_id (value: XXX).
Invalid key in stanza [additional_parameters] in /data/splunk/etc/apps/TA-MS-AAD/local/ta_ms_aad_settings.conf, line 3: client_secret (value: XXX).

Looking at the internal error log for this TA, I get <stderr> Introspecting scheme=azure_virtual_network: File "/data/splunk/etc/apps/TA-MS-AAD/bin/ta_ms_aad_declare.py", line 10, in <module>   Looking at the file, line 10 is the "import re" line

Not too sure where to go from here or if the 2 are linked.  Any help would be appreciated.

Thanks!

Labels (1)
0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!