All Apps and Add-ons
Highlighted

task config has no interval

Communicator

Not getting and Azure Audit logs after setup. We are on-prem. Any ideas?

Seeing this error in the logs:
2018-04-16 20:30:20,975 +0000 log_level=ERROR, pid=17164, tid=MainThread, file=ta_mod_input.py, func_name=main, code_line_no=199 | Microsoft Cloudservices Azure Audit task encounter exception
Traceback (most recent call last):
File "/app/install/splunk/etc/apps/Splunk_TA_microsoft-cloudservices/bin/splunktamscs/splunktaucclib/data_collection/ta_mod_input.py", line 196, in main
config_cls=configer_cls, log_suffix=log_suffix)
File "/app/install/splunk/etc/apps/Splunk_TA_microsoft-cloudservices/bin/splunktamscs/splunktaucclib/data_collection/ta_mod_input.py", line 111, in run
tconfig = tc.create_ta_config(settings, config_cls or tc.TaConfig, log_suffix)
File "/app/install/splunk/etc/apps/Splunk_TA_microsoft-cloudservices/bin/splunktamscs/splunktaucclib/data_collection/ta_config.py", line 203, in create_ta_config
return config_cls(meta_config, settings, stanza_name, log_suffix)
File "/app/install/splunk/etc/apps/Splunk_TA_microsoft-cloudservices/bin/splunktamscs/splunktaucclib/data_collection/ta_config.py", line 31, in __init__
self._load_task_configs()
File "/app/install/splunk/etc/apps/Splunk_TA_microsoft-cloudservices/bin/splunktamscs/splunktaucclib/data_collection/ta_config.py", line 60, in _load_task_configs
self._divide_settings)
File "/app/install/splunk/etc/apps/Splunk_TA_microsoft-cloudservices/bin/splunktamscs/splunktaucclib/data_collection/ta_config.py", line 80, in _generate_task_configs
assert task_config.get(c.interval), "task config has no interval " \
AssertionError: task config has no interval field

0 Karma
Highlighted

Re: task config has no interval

Motivator

Hey@davebo1896,

Have you created this stanza in inputs.conf?

[<input_stanza_name>]              
account = <value>
subscription_id = <value>
start_time = <value>
index = <value>
interval = <value>

is the interval parameter added?

Refer this doc:
http://docs.splunk.com/Documentation/AddOns/released/MSCloudServices/Configureinputs2
Let me know if this helps!!

0 Karma
Highlighted

Re: task config has no interval

Communicator

Thanks @deepashri_123,

I had assumed the GUI would add that as it created them. It had not. I manually updated each section with an interval, then restarted.

Unfortunately, still getting the error and not getting data.

0 Karma
Highlighted

Re: task config has no interval

Motivator

Is the error still the same or error is different?

0 Karma
Highlighted

Re: task config has no interval

Communicator

Same error

0 Karma
Highlighted

Re: task config has no interval

Splunk Employee
Splunk Employee

Some of the configs are stored in the KV store. I've run into issues in the past if I try to create an input with the same name as a failed or previously deleted input. Try creating the input again with a unique name.

0 Karma
Highlighted

Re: task config has no interval

Communicator

It appears the problem is caused by the ordering of the configs
(and the UI does not put them in the correct order)

The stanza has to be configured in the order listed in the documentation:

 [<input_stanza_name>]              
 account = <value>
 subscription_id = <value>
 start_time = <value>
 index = <value>
 interval = <value>

View solution in original post

Highlighted

Re: task config has no interval

Splunk Employee
Splunk Employee

Yes, I discovered this today, it needs to match what you said, just like in this doc:

https://docs.splunk.com/Documentation/AddOns/released/MSCloudServices/Configureinputs2

Because this is a non-standard .conf file (mscs_azure_audit_inputs.conf), guessing it's processed by a script that's not being smart (i.e. automatically throwing into an object without checking the key-value pairs...). This is either a bug in the UI or in the script processing this .conf file.

0 Karma