Splunk App for Microsoft SharePoint: Why is the Lookup Table Rebuilder not running and spaudit13.exe creates these error messages?

[Spranta]

Hi together,

We just started with Splunk and our first project should be the monitoring from our SharePoint farm. Now we've got two problems.

1) The Lookup Table Rebuilder is not running
2) The spaudit13.exe creates a lot of these error messages:

04-27-2016 09:12:16.397 +0200 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\etc\apps\TA_Microsoft-Sharepoint\bin\sp13audit.exe"" Unable to access Site 2716fcca-953d-4037-b177-516c66566f44: System.NullReferenceException System.NullReferenceException: Object reference not set to an instance of an object.
04-27-2016 09:12:16.397 +0200 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\etc\apps\TA_Microsoft-Sharepoint\bin\sp13audit.exe""    at Microsoft.SharePoint.SPAudit.GetEntries(SPAuditQuery query)
04-27-2016 09:12:16.397 +0200 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\etc\apps\TA_Microsoft-Sharepoint\bin\sp13audit.exe""    at Microsoft.SharePoint.SPAudit.GetEntries()
04-27-2016 09:12:16.397 +0200 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\etc\apps\TA_Microsoft-Sharepoint\bin\sp13audit.exe""    at Splunk.SharePoint2013.Audit.Program.ProcessSiteCollection(EventStreamWriter writer, SPSite site, SPFarm localFarm)
04-27-2016 09:12:16.397 +0200 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\etc\apps\TA_Microsoft-Sharepoint\bin\sp13audit.exe""    at Splunk.SharePoint2013.Audit.Program.<>c__DisplayClass8.b__4()

and

04-27-2016 10:26:28.257 +0200 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\etc\apps\TA_Microsoft-Sharepoint\bin\sp13audit.exe""    at Splunk.SharePoint2013.Audit.SplunkAuditEntry.get_UserName()
04-27-2016 10:26:28.257 +0200 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\etc\apps\TA_Microsoft-Sharepoint\bin\sp13audit.exe"" Unable to get user by Id -1: Microsoft.SharePoint.SPException Microsoft.SharePoint.SPException: User cannot be found.
04-27-2016 10:26:28.257 +0200 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\etc\apps\TA_Microsoft-Sharepoint\bin\sp13audit.exe""    at Microsoft.SharePoint.SPUserCollection.GetByID(Int32 id)
04-27-2016 10:26:28.257 +0200 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\etc\apps\TA_Microsoft-Sharepoint\bin\sp13audit.exe""    at Splunk.SharePoint2013.Audit.SplunkAuditEntry.get_UserName()

Any ideas?

Thanks
Alex

[jfunderburg]

Well, Do you have McAfee? I had a similiar issue with Python.exe McAfee was Blocking it.

[nicolasmai]

Same problem here, anyone found a solution for this issue?

Any one who got this app fully working?

[BenTan]

Anyone out there has a solution for this?? Facing the same issue as well..