[ms_o365_message_trace://Ouro365data]
delay_throttle = 1440
index = o365
input_mode = continuously_monitor
interval = 3600
office_365_password = THE_PASSWORD
office_365_username = Our_account@email.thing.stuff
query_window_size = 60
sourcetype = ms:o365:reporting:messagetrace
^That is our inputs.conf in local for the app. Was created via the GUI. However, after upgrade and having to switch to user/password, the app is now complaining about query window size.
HTTPError: HTTP 500 Internal Server Error -- {"messages":[{"type":"ERROR","text":"Unexpected error \"<class 'splunktaucclib.rest_handler.error.RestError'>\" from python handler: \"REST Error [400]: Bad Request -- HTTP 400 Bad Request -- 'Query Window Size' is required and should be at least 1 minute.\". See splunkd.log for more details."}]}
That is from the var/log/splunk/ta_ms_o365_reporting_ms_o365_message_trace.log
06-26-2018 18:01:36.514 +0000 ERROR AdminManagerExternal - Stack trace from python handler:\nTraceback (most recent call last):\n File "/opt/splunk/lib/python2.7/site-packages/splunk/admin.py", line 130, in init\n hand.execute(info)\n File "/opt/splunk/lib/python2.7/site-packages/splunk/admin.py", line 594, in execute\n if self.requestedAction == ACTION_LIST: self.handleList(confInfo)\n File "/opt/splunk/etc/apps/TA-MS_O365_Reporting/bin/ta_ms_o365_reporting/splunk_aoblib/rest_migration.py", line 38, in handleList\n AdminExternalHandler.handleList(self, confInfo)\n File "/opt/splunk/etc/apps/TA-MS_O365_Reporting/bin/ta_ms_o365_reporting/splunktaucclib/rest_handler/admin_external.py", line 40, in wrapper\n for entity in result:\n File "/opt/splunk/etc/apps/TA-MS_O365_Reporting/bin/ta_ms_o365_reporting/splunktaucclib/rest_handler/handler.py", line 118, in wrapper\n raise RestError(exc.status, exc.message)\nRestError: REST Error [400]: Bad Request -- HTTP 400 Bad Request -- 'Query Window Size' is required and should be at least 1 minute.\n
^Splunkd.log line
Has anyone else had this issue or have a fix. I've completely deleted the local folder (after backup) and then even re-installed the app fresh and created an input from scratch. Still not recognizing that query_window_size is set.
Please help
... View more
