All Apps and Add-ons

Splunk Add-on for Microsoft Office 365 hangs randomly

wojtek25
Engager

Hello,

plugin is configured to get Office 365 audit logs (Exchange, Sharepoint, Teams, etc.).
The problem is that from time to time it's just stops ingesting some of inputs.
If then input is manually disabled and enabled from a GUI, ingesting is working again.

Internal log shows no errors, just standard messages like: ..success, ..found, ..available content.
Then after a gap there is a message: Loop has been aborted (which is probably according to disabling/enabling input). After that there are standard messages again.

  1. Has anybody had similar problem with this plugin and what could be a solution?
  2. Would you suggest using another app: Splunk Add-on for Microsoft Cloud Services (https://splunkbase.splunk.com/app/3110/#/overview) ?

Regards,
Wojtek

wojtek25
Engager

Here are the changes to the scripts that fix that problem:

In lines 166 to 168 in file splunk_ta_o365/bin/splunk_ta_o365/common/portal.py, add timeout at line 167 like this:

logger.debug(‘Calling management activity API.’, url=url, params=params)
response = session.request(method, url, params=params, timeout=60)
status_code = response.status_code

In lines from 117 - 119 in file splunk_ta_o365/bin/splunk_ta_o365/modinputs/management_activity.py, change the lines 117 and 119 like this:

now = self._now() // 86400 * 86400 + 86400
end_time = datetime.utcfromtimestamp(now)
start_time = end_time - timedelta(days=7)

Regards,
Wojtek

crisponions2
Explorer

I am having this issue as well and have been for a while. I had a cron job running that disabled and reenabled the ingesting every night, but it seems to be failing several times a a day now.

Same symptoms. Suddenly I will show no input, nothing in the logs of why it stopped. If I disable/enable from the GUI eveything starts flowing again.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...