All Apps and Add-ons

Splunk App for Microsoft SharePoint: Why is the Lookup Table Rebuilder not running and spaudit13.exe creates these error messages?

Spranta
Splunk Employee
Splunk Employee

Hi together,

We just started with Splunk and our first project should be the monitoring from our SharePoint farm. Now we've got two problems.

1) The Lookup Table Rebuilder is not running
2) The spaudit13.exe creates a lot of these error messages:

04-27-2016 09:12:16.397 +0200 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\etc\apps\TA_Microsoft-Sharepoint\bin\sp13audit.exe"" Unable to access Site 2716fcca-953d-4037-b177-516c66566f44: System.NullReferenceException System.NullReferenceException: Object reference not set to an instance of an object.
04-27-2016 09:12:16.397 +0200 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\etc\apps\TA_Microsoft-Sharepoint\bin\sp13audit.exe""    at Microsoft.SharePoint.SPAudit.GetEntries(SPAuditQuery query)
04-27-2016 09:12:16.397 +0200 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\etc\apps\TA_Microsoft-Sharepoint\bin\sp13audit.exe""    at Microsoft.SharePoint.SPAudit.GetEntries()
04-27-2016 09:12:16.397 +0200 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\etc\apps\TA_Microsoft-Sharepoint\bin\sp13audit.exe""    at Splunk.SharePoint2013.Audit.Program.ProcessSiteCollection(EventStreamWriter writer, SPSite site, SPFarm localFarm)
04-27-2016 09:12:16.397 +0200 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\etc\apps\TA_Microsoft-Sharepoint\bin\sp13audit.exe""    at Splunk.SharePoint2013.Audit.Program.<>c__DisplayClass8.b__4()

and

04-27-2016 10:26:28.257 +0200 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\etc\apps\TA_Microsoft-Sharepoint\bin\sp13audit.exe""    at Splunk.SharePoint2013.Audit.SplunkAuditEntry.get_UserName()
04-27-2016 10:26:28.257 +0200 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\etc\apps\TA_Microsoft-Sharepoint\bin\sp13audit.exe"" Unable to get user by Id -1: Microsoft.SharePoint.SPException Microsoft.SharePoint.SPException: User cannot be found.
04-27-2016 10:26:28.257 +0200 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\etc\apps\TA_Microsoft-Sharepoint\bin\sp13audit.exe""    at Microsoft.SharePoint.SPUserCollection.GetByID(Int32 id)
04-27-2016 10:26:28.257 +0200 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\etc\apps\TA_Microsoft-Sharepoint\bin\sp13audit.exe""    at Splunk.SharePoint2013.Audit.SplunkAuditEntry.get_UserName()

Any ideas?

Thanks
Alex

0 Karma

jfunderburg
Explorer

Well, Do you have McAfee? I had a similiar issue with Python.exe McAfee was Blocking it.

0 Karma

nicolasmai
New Member

Same problem here, anyone found a solution for this issue?

Any one who got this app fully working?

0 Karma

BenTan
Path Finder

Anyone out there has a solution for this?? Facing the same issue as well..

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...