Splunk Add-on for Microsoft Cloud Services and Office 365 no longer collecting data

[shaunm001]

Hello, two of our Splunk apps "Splunk Add-on for Microsoft Cloud Services" and "Splunk Add-on for Office 365" are no longer collecting data. It looks like they stopped working June 30. I checked the client secret in the Azure App Registrations panel and it had not expired. I went ahead and created a new key anyway and updated the two Splunk app configurations with the new key, but they still aren't collecting any data. I checked index="_internal" log_level=ERROR but didn't really see anything that stood out specific to these apps. Any suggestions on settings I can check, other logs to examine, etc?

[livehybrid · Accepted solution]

Hi @shaunm001 

Is this on-premise? Do you have any firewalls between your Splunk server and the internet that could be causing an issue? 

Given that they both stopped together Im leaning towards either connectivity or expired cert, since you've tried a new secret already Im leaning towards connectivity! 

There may be other log levels reporting errors, or different fields. I think O365 app uses "level=Error" for example. Have a look at the following as a starting point

index=_internal sourcetype="splunk:ta:o365:log"

Does this show any issues around connectivity, 401/400 errors or anything like this?

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[shaunm001]

This was helpful and issue looks to be with KV Store failing to initialize due to expired server certificate. I've opened a ticket with Splunk support to get help with generating a new certificate and updating our configuration. Thanks for help!