All Apps and Add-ons

Office 365 Add-On connection errors - unhandled exceptions

craigkleen
Communicator

Hello,

We've followed the instructions for version 2.0.2 of splunk_ta_o365, running on a Splunk 8.0.2 HF. But in the logs we're getting:

2020-05-28 07:45:25,328 level=ERROR pid=2827626 tid=MainThread logger=splunk_ta_o365.modinputs.management_activity pos=utils.py:wrapper:67 | datainput=b'O365_Management_Activity' start_time=1590677124 | message="Data input was interrupted by an unhandled exception."
Traceback (most recent call last):
File "/opt/splunk/etc/apps/splunk_ta_o365/bin/splunksdc/utils.py", line 65, in wrapper
return func(*args, **kwargs)
File "/opt/splunk/etc/apps/splunk_ta_o365/bin/splunk_ta_o365/modinputs/management_activity.py", line 102, in run
executor.run(adapter)
File "/opt/splunk/etc/apps/splunk_ta_o365/bin/splunksdc/batch.py", line 47, in run
for jobs in delegate.discover():
File "/opt/splunk/etc/apps/splunk_ta_o365/bin/splunk_ta_o365/modinputs/management_activity.py", line 127, in discover
subscription.start(session)
File "/opt/splunk/etc/apps/splunk_ta_o365/bin/splunk_ta_o365/common/portal.py", line 160, in start
response = self.perform(session, 'POST', '/subscriptions/start', params)
File "/opt/splunk/etc/apps/splunk_ta_o365/bin/splunk_ta_o365/common/portal.py", line 169, in _perform
return self._request(session, method, url, kwargs)
File "/opt/splunk/etc/apps/splunk_ta_o365/bin/splunk_ta_o365/common/portal.py", line 181, in _request
raise O365PortalError(response)
File "/opt/splunk/etc/apps/splunk_ta_o365/bin/splunk_ta_o365/common/portal.py", line 26, in __init
_
message = str(response.status_code) + ':' + payload
TypeError: can only concatenate str (not "bytes") to str

We've checked and rechecked our Azure permissions, which look like:
alt text

Hoping someone has a lead on what's going wrong. At least one poster with a similar error said that "Grant Permissions" was missed on the Azure side, but as far as we can tell it looks OK there.

Thanks

Labels (1)
0 Karma
1 Solution

craigkleen
Communicator

Yeah, answering my own post.

The issue was that we used the wrong "endpoint". We chose "USGovGCCHigh" instead of "Worldwide", because Worldwide kept erroring out. Lesson-learned that the Worldwide looked different to our Palo Alto Firewall as far as the "app ID" went, so the PAN blocked it. Once the firewall was open, and we switched the Endpoint to Worldwide, it worked perfectly.

View solution in original post

0 Karma

craigkleen
Communicator

Yeah, answering my own post.

The issue was that we used the wrong "endpoint". We chose "USGovGCCHigh" instead of "Worldwide", because Worldwide kept erroring out. Lesson-learned that the Worldwide looked different to our Palo Alto Firewall as far as the "app ID" went, so the PAN blocked it. Once the firewall was open, and we switched the Endpoint to Worldwide, it worked perfectly.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...