All Apps and Add-ons

Why the error while collecting logs using Azure Log Analytics Kusto Grabber?

meghasinghal
Engager

We would like to collect logs from Azure Log Analytics workspace and have configured addon Azure Log Analytics Kusto Grabber, but we are getting below error while collecting the logs-

2022-05-04 08:54:52,440 ERROR pid=29779 tid=MainThread file=base_modinput.py:log_error:309 | Get error when collecting events. Traceback (most recent call last): File "$SPLUNK HOME$/etc/apps/TA-azure-log-analytics-kql-grabber/bin/ta_azure_log_analytics_kql_grabber/aob_py3/modinput_wrapper/base_modinput.py", line 128, in stream_events self.collect_events(ew) File "$SPLUNK HOME$/etc/apps/TA-azure-log-analytics-kql-grabber/bin/azure_log_analytics.py", line 88, in collect_events input_module.collect_events(self, ew) File "$SPLUNK HOME$/etc/apps/TA-azure-log-analytics-kql-grabber/bin/input_module_azure_log_analytics.py", line 94, in collect_events raise e File "$SPLUNK HOME$/etc/apps/TA-azure-log-analytics-kql-grabber/bin/input_module_azure_log_analytics.py", line 63, in collect_events rows = len(result.json()["tables"][0]["rows"]) KeyError: 'tables'

Labels (1)
Tags (4)
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Analytics Workspace removal in Splunk 10.6

In Splunk Cloud Platform and Splunk Enterprise 10.6, Analytics Workspace is removed from product and no longer ...

Vibe-coding, AI, and Splunkcraft: Highlights from the .conf26 Builder Bar

If you stopped by the Builder Bar at .conf26, thank you! This year, we brought ...

Thanks for the Memories: .conf26 Took Learning to New Heights

Thank you, Splunk Community, for making .conf26 in Denver one for the books. From packed Splunk University ...