I have been using Microsoft Azure add-on for Splunk to ingest Azure sign in logs for over a year and today I see the following error:
021-11-08 16:31:12,318 ERROR pid=4614 tid=MainThread file=base_modinput.py:log_error:309 | Traceback (most recent call last):
File "/opt/splunk/etc/apps/TA-MS-AAD/bin/ta_ms_aad/aob_py3/splunklib/binding.py", line 1262, in request
raise HTTPError(response)
splunklib.binding.HTTPError: HTTP 500 Internal Server Error -- b'{"messages":[{"type":"ERROR","text":"Unexpected error \\"<class \'splunktaucclib.rest_handler.error.RestError\'>\\" from python handler: \\"REST Error [400]: Bad Request -- HTTP 400 Bad Request -- int() argument must be a string, a bytes-like object or a number, not \'NoneType\'\\". See splunkd.log for more details."}]}'
Has anyone else experiencing this issue?
I managed to fix it. I edited credentials in addon configuration and saved it. The same for inputs - edit & save. Started to work.
I recreated the input on the add-on and recreated the app registration in Azure and still not working for me
All these addons write to specific logfile can you search for more specific error in there. Mostly these addons have webhooks that they use to get data from azure application and if this one is also using a webhook is that webhook publicly available. and when the data is fetched it writes to a check point file somewhere and that gets corrupt too.
Same for me...
2021-11-09 09:34:44,317 ERROR pid=8468 tid=MainThread file=base_modinput.py:log_error:309 | _Splunk_ Unable to obtain access token
Hi,
Have you guys found any fix for this issue??
Thanks.
Hi,
I have been using Microsoft Azure add-on for Splunk for a year.
I also saw following message,
"ERROR pid=9511 tid=MainThread file=base_modinput.py:log_error:309 | _Splunk_ Unable to obtain access token"
And create new secret id and value on Azure AD, and apply it ot the splunk app.
However I could not fix the issue.
Has anyone else experiencing this issue?
was this issue fixed?
Yes, fixed. However the cause is unknown..
what did you do to fix the issue?