All Apps and Add-ons

How to resolve splunk_ta_o365_management_activity.py errors?

timdowning
Engager

I am trying to use Splunk Add-on for Office 365 on a HWF.

I have found one other question relating to "Resource temporarily unavailable" but the solution is not applicable.

It is collecting most events and they are visible in search, however no SharePoint audit events are showing. Splunkd.log shows the following errors for the TA:

message from "python /opt/splunk/etc/apps/splunk_ta_o365/bin/splunk_ta_o365_management_activity.py"

IOError: [Errno 11] Resource temporarily unavailable
        fcntl.flock(fd, fcntl.LOCK_EX | fcntl.LOCK_NB)
    File "/opt/splunk/etc/apps/splunk_ta_o365/bin/splunksdc/utils.py", line 22, in lock
        self._lock(self._fd)
    File "/opt/splunk/etc/apps/splunk_ta_o365/bin/splunksdc/utils.py", line 42, in acquire
        self.acquire()
    File "/opt/splunk/etc/apps/splunk_ta_o365/bin/splunksdc/utils.py", line 48, in __enter__
        with self._sylock(folder):
    File "/opt/splunk/etc/apps/splunk_ta_o365/bin/splunksdc/collector.py", line 244, in run
        code = app.run()
    File "/opt/splunk/etc/apps/splunk_ta_o365/bin/splunksdc/collector.py", line 118, in run_modular_input
        run_modular_input(factory, **kwargs)
    File "/opt/splunk/etc/apps/splunk_ta_o365/bin/splunksdc/collector.py", line 199, in main
        arguments=arguments,
    File "/opt/splunk/etc/apps/splunk_ta_o365/bin/splunk_ta_o365/modinputs/management_activity.py", line 216, in main
        instance.main()
    File "/opt/splunk/etc/apps/splunk_ta_o365/bin/splunk_ta_o365_bootstrap.py", line 34, in run_module
        run_module('splunk_ta_o365.modinputs.management_activity')
    File "/opt/splunk/etc/apps/splunk_ta_o365/bin/splunk_ta_o365_management_activity.py", line 4, in <module>
Traceback (most recent call last):   

Any help appreciated,
Thanks

Labels (1)
0 Karma

gordo32
Communicator

This is a very old posting, but ran into this today with only 1 of my inputs from O365 (total of 6) after changing the Secret token (and even rebooting).

I found that deleting and re-creating the input resolved it. I'm guessing that after the Secret was changed, something in the input didn't get properly updated.

Thanks,

Gord T.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...