Splunk TA Cloud Services authentication error Cisco Umbrella user?

[dkeck]

Hello,

does anyone here have an idea why cisco cloud security umbrella addon is interfering the authentication within Splunk TA Cloud Services?

I try to ingest nsg flow data via a storage blob. All the other inputs within the Cloud Services TA are working (azure audit data via eventhub). When I disable the umbrella TA nsg flow logs can be received without a problem.
 

File "/opt/splunk/etc/apps/Splunk_TA_microsoft-cloudservices/lib/solnlib/credentials.py", line 137, in get_password f"Failed to get password of realm={self._realm}, user={user}." solnlib.credentials.CredentialNotExistException: Failed to get password of realm=__REST_CREDENTIAL__#Splunk_TA_microsoft-cloudservices#configs/conf-inputs, user=cisco_cloud_security_umbrella_addon://UmbrellaDNS.

Feels like some python issue? 

Thankful for any hint I can get.

David

[dkeck · Accepted solution]

I moved the umbrella TA to a different HF. Wokred for me, but still just a workaround.