Teams add-on for Splunk - missing call records

[navotfk]

Hi Team,

We had successfully leveraged MS Teams Add-On for Splunk to collect Teams call records and user reports data until recently. This past July we switched our systems to GCCH and since then we’ve only been collecting user reports from the Add-On, no call records.

After some troubleshooting, we found this error in the Splunk internal logs ("_Splunk_ Could not get access token") but couldn’t figure out how to resolve it. All access look good on our end but still the error persists.

Please any help would be appreciated

[navotfk]

An update on this issue: 
I am now getting this error in Splunk. Any idea what could be the issue here? Firewall rules have been checked and all, no messages from graph are being dropped.

[thahir]

@navotfk  Can you share your endpoint which you are using in the app.

[navotfk]

@thahir any ideas please?

[navotfk]

@thahir  the endpoint i picked in the app: v1.0

[navotfk]

v1.0

[livehybrid]

Hi @navotfk 

Can you confirm that you've entered the secret "Value" and not the "Secret ID" from the Azure Portal? Ive seen this mistake made previously and give this error.

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[navotfk]

@livehybrid yes, I am using the secret value.

[navotfk]

@thahir yes, and verified client, secret and environment are correct.  Teams add-on is installed on the HF only

I also found this document_link that I followed but still no results.

[thahir]

@navotfk , Did you give the below API permission in the Azure portal?

CallRecords.Read.All