Splunk Add-on for Microsoft Security Failed to load Inputs Page

[ryan_629]

I recently installed the Splunk Add-on for Microsoft Security to Splunk Cloud and configured it to connect via API to an app registered in Azure. The data is still not loading on the Security section of the Microsoft 365 App for Splunk. I checked in Azure and Incident.Read has permissions enabled on the app. The Splunk documentation says that I should go to Add-on > Inputs and click Create New Input to complete the configuration. When I go to the Inputs page I get the message: "Failed to load Inputs Page
This is normal on Splunk search heads as they do not require an Input page. Check your installation or return to the configuration page. Error: Request failed with status code 500". 

I am not sure how I can fix this as I have no other place to put the endpoints as Inputs.

[VatsalJagani · Accepted solution]

@ryan_629 - This is common in the classic Splunk cloud environment as it removes the inputs.conf.spec file and inputs.conf files.

These files are necessary to collect the data and also to load the Add-on UI.

You have two options:

• Use IDM machine in Splunk Cloud - https://www.splunk.com/en_us/blog/platform/introducing-inputs-data-manager-on-splunk-cloud.html
• Go to Splunk Cloud Victoria experience, as it will allow you to run inputs on the search head.
  • 

I hope this helps!! Karma/upvote would be appreciated!!!

[ryan_629]

Thanks very much, I will try this