All Apps and Add-ons

Splunk Add-on for Microsoft Office 365 hangs randomly



plugin is configured to get Office 365 audit logs (Exchange, Sharepoint, Teams, etc.).
The problem is that from time to time it's just stops ingesting some of inputs.
If then input is manually disabled and enabled from a GUI, ingesting is working again.

Internal log shows no errors, just standard messages like: ..success, ..found, ..available content.
Then after a gap there is a message: Loop has been aborted (which is probably according to disabling/enabling input). After that there are standard messages again.

  1. Has anybody had similar problem with this plugin and what could be a solution?
  2. Would you suggest using another app: Splunk Add-on for Microsoft Cloud Services ( ?



Here are the changes to the scripts that fix that problem:

In lines 166 to 168 in file splunk_ta_o365/bin/splunk_ta_o365/common/, add timeout at line 167 like this:

logger.debug(‘Calling management activity API.’, url=url, params=params)
response = session.request(method, url, params=params, timeout=60)
status_code = response.status_code

In lines from 117 - 119 in file splunk_ta_o365/bin/splunk_ta_o365/modinputs/, change the lines 117 and 119 like this:

now = self._now() // 86400 * 86400 + 86400
end_time = datetime.utcfromtimestamp(now)
start_time = end_time - timedelta(days=7)



I am having this issue as well and have been for a while. I had a cron job running that disabled and reenabled the ingesting every night, but it seems to be failing several times a a day now.

Same symptoms. Suddenly I will show no input, nothing in the logs of why it stopped. If I disable/enable from the GUI eveything starts flowing again.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...