Splunk Add-on for Microsoft Cloud Services showing proxy issue

[rbal_splunk]

We are experiencing a proxy issue with the Splunk Add-on for Microsoft Cloud Service. The add-on supports proxy for Azure Audit and Resource data inputs, however, it does not work when enabling this functionality.

We have also tried configuring the proxy on the local system by adding the environment variable below to the splunk/etc/splunk-launch.conf file to no avail.

http_proxy=<proxy_host>:<port_number>
https_proxy=<proxy_host>:<port_number>

Analyzing the network traffic using tcpdump reveal that the add-on does not even try to connect using the proxy. There is not a single SYN tcp flag to the proxy.

[rbal_splunk · Accepted solution]

Found out that this issue is expected to be fixed in Splunk Add-on for Microsoft Cloud Services version 3.0.0
Here is workaround that worked

Open file %SPLUNK_HOME%/etc/appsSplunk_TA_microsoft-cloudservices/bin/splunktamscs/mscs_azure_base_data_collector.py with a text editor. Locate the following lines (the two digests in front indicate line number in 2.1.x release, it may differ if the user us running another version:

59 def _get_proxies(proxy_config):
60    proxy_as_tuple = proxy_from_config(proxy_config)
61    if not proxy_as_tuple:
62        return None
63    host, port, user, password = proxy_as_tuple
64    if user and password:
65        proxy_string = '{user}:{password}@{host}:{port}'.format(
66            user=user, password=password, host=host, port=port
67        )
68    else:
69        proxy_string = '{host}:{port}'.format(host=host, port=port)
70    return {
71        'http': 'http://{}'.format(proxy_string),
72        'https': 'https://{}'.format(proxy_string)
73    }

then change (line 72)

'https': 'https://{}'.format(proxy_string)
to (replace the second 'https' to 'http')
'https': 'http://{}'.format(proxy_string)

Finally, change (line 113)

self._credentials = ProxyableServicePrincipalCredentials(
 to
self._credentials = ServicePrincipalCredentials( 

Hope this helps.