I am trying to configure a new input in the Splunk Add-on for Microsoft Office 365. I am receiving errors which I have not been able to fix. Assistance would be greatly appreciated.
- Input Name: AuditLogs.Signins
- Input Type: Graph API
2022-03-22 12:24:38,005 level=ERROR pid=3126388 tid=MainThread logger=splunk_ta_o365.modinputs.graph_api pos=utils.py:wrapper:72 | datainput=b'AuditLogsSignins' start_time=1647966277 | message="Data input was interrupted by an unhandled exception."
Traceback (most recent call last):
File "/opt/splunk/etc/apps/splunk_ta_o365/bin/splunksdc/utils.py", line 70, in wrapper
return func(*args, **kwargs)
File "/opt/splunk/etc/apps/splunk_ta_o365/bin/splunk_ta_o365/modinputs/graph_api.py", line 235, in run
2022-03-22 12:24:38,004 level=ERROR pid=3126388 tid=MainThread logger=splunk_ta_o365.modinputs.graph_api pos=graph_api.py:run:118 | datainput=b'AuditLogsSignins' start_time=1647966277 | message="Error retrieving Cloud Application Security messages." exception='NoneType' object is not iterable
2022-03-22 12:24:37,999 level=ERROR pid=3126388 tid=MainThread logger=splunk_ta_o365.common.portal pos=portal.py:get:476 | datainput=b'AuditLogsSignins' start_time=1647966277 | message="There was an exception processing the response from Microsoft Graph API" exception=401:{"error":{"code":"InvalidAuthenticationToken","message":"Access token validation failure. Invalid audience.","innerError":{"date":"2022-03-22T16:24:37","request-id":"","client-request-id":""}}}
Traceback (most recent call last):
File "/opt/splunk/etc/apps/splunk_ta_o365/bin/splunk_ta_o365/common/portal.py", line 467, in get
raise O365PortalError(response)
splunk_ta_o365.common.portal.O365PortalError: 401:{"error":{"code":"InvalidAuthenticationToken","message":"Access token validation failure. Invalid audience.","innerError":{"date":"2022-03-22T16:24:37","request-id":"","client-request-id":""}}}
2022-03-22 12:24:37,814 level=INFO pid=3126388 tid=MainThread logger=splunk_ta_o365.common.portal pos=portal.py:get:462 | datainput=b'AuditLogsSignins' start_time=1647966277 | message="Calling Microsoft Graph API." url=b'https://graph.microsoft.us/v1.0/auditLogs/signIns' params=None
