anyone familiar with this error in splunkd for o365 TA

[Bentash]

10-23-2019 00:30:50.477 +0000 ERROR PersistentScript - From {/opt/splunk/bin/python /opt/splunk/lib/python2.7/site-packages/splunk/persistconn/appserver.py}: /opt/splunk/etc/apps/splunk_ta_o365/bin/3rdparty/urllib3/connectionpool.py:846: InsecureRequestWarning: Unverified HTTPS request is being made. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#ssl-warnings
10-23-2019 00:30:50.477 +0000 ERROR PersistentScript - From {/opt/splunk/bin/python /opt/splunk/lib/python2.7/site-packages/splunk/persistconn/appserver.py}: InsecureRequestWarning)

[Nekomimi]

Hi,

Has anyone found the solution to this yet?

[MuS]

Hi Bentash,

If I recall it correct this (using an unverified SSL connection) was done to prevent data collection issues in case of any SSL certs issues in o365/Azure. It tells you that the SSL certificate is not validated.

Long story short, this is not really an error more a warning and should be reported as such like the actual python error tells you it is just a warning : InsecureRequestWarning

Hope this helps ...

cheers, MuS

[a212830]

I'm no sure that I'd call this something to ignore. Don't we want to use validated SSL certificates?

[MuS]

Well, it come all down to two options:

1. accept the fact that you will loss events if you enable the SSL verification and something happens in Azure which invalidates the certificate
2. accept the less secure connection when not verifying the certificate but continue to get events even something happens in Azure which invalidates the certificate

cheers, MuS

[a212830]

Agreed. I think the secure connection is important.

[MuS]

In this case the error message actually tells you what to do 😉

10-23-2019 00:30:50.477 +0000 ERROR PersistentScript - From {/opt/splunk/bin/python /opt/splunk/lib/python2.7/site-packages/splunk/persistconn/appserver.py}: /opt/splunk/etc/apps/splunk_ta_o365/bin/3rdparty/urllib3/connectionpool.py:846: InsecureRequestWarning: Unverified HTTPS request is being made. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#ssl-warnings

cheers, MuS

[mmqt]

In the same boat, unable to pull any data now

[twellinghurst]

I'm getting this same error. Have you found any solution?