I have been working on this issue for several days now and cannot seem to pull message trace data over to Splunk via OAuth using Splunk Add-on for Microsoft Office 365 Reporting Web Service 2.0.1 on Splunk 8.1.1 The following is the error that is thrown.
ERROR pid=42990 tid=MainThread file=base_modinput.py:log_error:316 | Get error when collecting events.
Traceback (most recent call last):
File "/opt/splunk/etc/apps/TA-MS_O365_Reporting/lib/splunktaucclib/modinput_wrapper/base_modinput.py", line 140, in stream_events
self.collect_events(ew)
File "/opt/splunk/etc/apps/TA-MS_O365_Reporting/bin/ms_o365_message_trace_oauth.py", line 355, in collect_events
get_events_continuous(helper, ew)
File "/opt/splunk/etc/apps/TA-MS_O365_Reporting/bin/ms_o365_message_trace_oauth.py", line 97, in get_events_continuous
messages = message_response['value'] or None
TypeError: 'NoneType' object is not subscriptable
Any help on this issue is greatly appreciated.
I was using the wrong ID for the Client ID. Make sure you use the Application (client) ID