Getting Data In

okta logs into splunk, error 309

mayson
Engager

I configured the okta identity cloud for splunk App to ingest okta logs into splunk but getting the error message below:

2021-12-21 16:34:35,586 ERROR pid=1375 tid=MainThread file=base_modinput.py:log_error:309 | Get error when collecting events.
Traceback (most recent call last):
File "/opt/splunk/etc/apps/TA-Okta_Identity_Cloud_for_Splunk/bin/ta_okta_identity_cloud_for_splunk/aob_py3/solnlib/modular_input/checkpointer.py", line 218, in get
record = self._collection_data.query_by_id(key)
File "/opt/splunk/etc/apps/TA-Okta_Identity_Cloud_for_Splunk/bin/ta_okta_identity_cloud_for_splunk/aob_py3/solnlib/packages/splunklib/client.py", line 3648, in query_by_id
return json.loads(self._get(UrlEncoded(str(id))).body.read().decode('utf-8'))
File "/opt/splunk/etc/apps/TA-Okta_Identity_Cloud_for_Splunk/bin/ta_okta_identity_cloud_for_splunk/aob_py3/solnlib/packages/splunklib/client.py", line 3618, in _get
return self.service.get(self.path + url, owner=self.owner, app=self.app, sharing=self.sharing, **kwargs)
File "/opt/splunk/etc/apps/TA-Okta_Identity_Cloud_for_Splunk/bin/ta_okta_identity_cloud_for_splunk/aob_py3/solnlib/packages/splunklib/binding.py", line 289, in wrapper
return request_fun(self, *args, **kwargs)
File "/opt/splunk/etc/apps/TA-Okta_Identity_Cloud_for_Splunk/bin/ta_okta_identity_cloud_for_splunk/aob_py3/solnlib/packages/splunklib/binding.py", line 71, in new_f
val = f(*args, **kwargs)
File "/opt/splunk/etc/apps/TA-Okta_Identity_Cloud_for_Splunk/bin/ta_okta_identity_cloud_for_splunk/aob_py3/solnlib/packages/splunklib/binding.py", line 679, in get
response = self.http.get(path, all_headers, **query)
File "/opt/splunk/etc/apps/TA-Okta_Identity_Cloud_for_Splunk/bin/ta_okta_identity_cloud_for_splunk/aob_py3/solnlib/packages/splunklib/binding.py", line 1183, in get
return self.request(url, { 'method': "GET", 'headers': headers })
File "/opt/splunk/etc/apps/TA-Okta_Identity_Cloud_for_Splunk/bin/ta_okta_identity_cloud_for_splunk/aob_py3/solnlib/packages/splunklib/binding.py", line 1244, in request
raise HTTPError(response)
solnlib.packages.splunklib.binding.HTTPError: HTTP 503 Service Unavailable -- KV Store is initializing. Please try again later.
During handling of the above exception, another exception occurred:
Traceback (most recent call last):
File "/opt/splunk/etc/apps/TA-Okta_Identity_Cloud_for_Splunk/bin/ta_okta_identity_cloud_for_splunk/aob_py3/modinput_wrapper/base_modinput.py", line 128, in stream_events
self.collect_events(ew)
File "/opt/splunk/etc/apps/TA-Okta_Identity_Cloud_for_Splunk/bin/okta_identity_cloud.py", line 68, in collect_events
input_module.collect_events(self, ew)
File "/opt/splunk/etc/apps/TA-Okta_Identity_Cloud_for_Splunk/bin/input_module_okta_identity_cloud.py", line 774, in collect_events
lastTs = helper.get_check_point((cp_prefix + ":" + opt_metric + ":lastRun"))
File "/opt/splunk/etc/apps/TA-Okta_Identity_Cloud_for_Splunk/bin/ta_okta_identity_cloud_for_splunk/aob_py3/modinput_wrapper/base_modinput.py", line 521, in get_check_point
return self.ckpt.get(key)
File "/opt/splunk/etc/apps/TA-Okta_Identity_Cloud_for_Splunk/bin/ta_okta_identity_cloud_for_splunk/aob_py3/solnlib/utils.py", line 159, in wrapper
return func(*args, **kwargs)
File "/opt/splunk/etc/apps/TA-Okta_Identity_Cloud_for_Splunk/bin/ta_okta_identity_cloud_for_splunk/aob_py3/solnlib/modular_input/checkpointer.py", line 222, in get
'Get checkpoint failed: %s.', traceback.format_exc(e))
File "/opt/splunk/lib/python3.7/traceback.py", line 167, in format_exc
return "".join(format_exception(*sys.exc_info(), limit=limit, chain=chain))
File "/opt/splunk/lib/python3.7/traceback.py", line 121, in format_exception
type(value), value, tb, limit=limit).format(chain=chain))
File "/opt/splunk/lib/python3.7/traceback.py", line 508, in __init__
capture_locals=capture_locals)
File "/opt/splunk/lib/python3.7/traceback.py", line 337, in extract
if limit >= 0:
TypeError: '>=' not supported between instances of 'HTTPError' and 'int'

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Event Series: Splunk Observability Metrics Cost Optimization

Balancing Scale and Spend: Gaining Control Over High-Volume Metrics in Splunk Observability Cloud As ...

Kick the Tires Before You Commit: A Hands-On Tour of the Splunk Observability Cloud ...

Evaluating an enterprise observability platform usually goes like this: fill out a form, get a free trial with ...

Deep insights, no barriers: Splunk Observability Cloud Free Edition

As software delivery cycles continue to accelerate, observability shouldn’t be a luxury — it should be a ...