Microsoft Teams Add-on for Splunk - issue to get next data

[Cbr1sg]

Hi all,

I'm having issue with this add-on "Microsoft Teams Add-on for Splunk".

I currently use the add-on to get Teams Call Details Record downloaded to Splunk. For small call, this run well without issue. However, for big meeting when there are 200+ participants, call details record will be divided into several pages, and the URL to download next page is via "@odata.nextLink".

But this add-on doesn't seem to download next page, it stops after downloading the first page and therefore not all participants' details are downloaded to Splunk.

Via powershell, i can confirm that Graph API did return the "@odata.nextLink" (which was missing before, they only fixed it recently).

Look into python code,  the add-on uses function "get_item" to fetch the data, and this function doesn't care about nextLink at all, which explains why I encountered the issue. Below is the code of this get_item function

def get_item(helper, access_token, url):
    headers = {}
    headers["Authorization"] = "Bearer %s" % access_token
    headers["Content-type"] = "application/json"
    proxies = get_proxy(helper, "requests")

    try:
        r = requests.get(url, headers=headers, proxies=proxies)
        r.raise_for_status()
        response_json = None
        response_json = json.loads(r.content)
        item = response_json

    except Exception as e:
        raise e

    return item

I found another function within the same library that does look into nextLink data, which is get_items

def get_items(helper, access_token, url, items=[]):

    headers = {}
    headers["Authorization"] = "Bearer %s" % access_token
    headers["Content-type"] = "application/json"
    proxies = get_proxy(helper, "requests")

    try:
        r = requests.get(url, headers=headers, proxies=proxies)

        if r.status_code != 200:
            return items

        r.raise_for_status()
        response_json = None
        response_json = json.loads(r.content)
        items += response_json['value']

        if '@odata.nextLink' in response_json:
            nextLink = response_json['@odata.nextLink']

            # This should never happen, but just in case...
            if not is_https(nextLink):
                raise ValueError("nextLink scheme is not HTTPS. nextLink URL: %s" % nextLink)

            helper.log_debug("_Splunk_ nextLink URL (@odata.nextLink): %s" % nextLink)
            get_items(helper, access_token, nextLink, items)

    except Exception as e:
        raise e

    return items

So, what I did was changing the code from

call_record = azutils.get_item(helper, access_token, url)

to

call_record = azutils.get_items(helper, access_token, url)

but it doesn't work.

Anyone know how to get around this?

Thanks a lot