It appears that the management_api access token do not renew during normal operations and requires a restart of the splunk instance to force a renewal. These tokens are short-lived (59 min 59 sec). After which no ms:o365:management sourcetype data are successfully retrieved. Waited several hours before restarting. No data was retrieved until a restart was performed which resumed the data ingestion for this sourcetype.
Has anyone observed this behavior and resolved this successfully?
Is this a known TA bug?
Thanks
Did you configure a certificate? The certificate it used in the background to refresh API tokens -> https://msdn.microsoft.com/en-us/office-365/get-started-with-office-365-management-apis#configure-an...
For details on configuring a certificate, see this blog (step 29) https://www.splunk.com/blog/2017/07/27/splunking-microsoft-cloud-data-part-1.html
You can check the status of your certificate by going to O365 Troubleshooting tab in the add-on. You should see the text "Auto-generated and verified as valid" or similar depending on whether you used generated certificate or your own certificate.
,Did you configure a certificate? The certificate it used in the background to refresh API tokens -> https://msdn.microsoft.com/en-us/office-365/get-started-with-office-365-management-apis#configure-an...
For details on configuring a certificate, see this blog (step 29) https://www.splunk.com/blog/2017/07/27/splunking-microsoft-cloud-data-part-1.html
You can check the status of your certificate by going to O365 Troubleshooting tab in the add-on. You should see the text "Auto-generated and verified as valid" or similar depending on whether you used generated certificate or your own certificate.