Getting Data In

Unable to receive data from Splunk add-on for Microsoft cloud service

nithin204
Explorer

Hi Splunkers, We have a splunk HF on Azure and we have installed the add-on for Microsoft cloud services on the HF. I am able to connect to the storage account on Azure from the connection section with a SAS token. 

When I have created the inputs to collect the data from the blobs in the storage account, I don't see any data coming into splunk. I have tried leaving the blob filed empty and added wildcard(*) but still I don't see any data. 

 

The only error message that I see in the corresponding logs is the "AuthorizationResourceTypeMismatch" error. Not really sure what the error means and what permissions needs to be changed.   Has anyone faced this issue? Can someone please help

 

Labels (1)
0 Karma

shivanshu1593
Builder

What are the internal logs saying for this add-on in the _internal index. If you can share the error messages, we can help you find the solution.

For the error that you shared "AuthorizationResourceTypeMismatch", it usually indicates that credentials that you gave Splunk to connect to Azure do not have the authorization to perform the said operation. You may want to give it more permissions.

Thank you,
Shiv
###If you found the answer helpful, kindly consider upvoting/accepting it as the answer as it helps other Splunkers find the solutions to similar issues###
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...