I am having this issue as well and have been for a while. I had a cron job running that disabled and reenabled the ingesting every night, but it seems to be failing several times a a day now.
Same symptoms. Suddenly I will show no input, nothing in the logs of why it stopped. If I disable/enable from the GUI eveything starts flowing again.
... View more
I am having an issue with the Splunk add on for Office 365. It has been working somewhat fine for a couple months and then yesterday I started getting these errors.
2018-09-19 15:32:15,292 level=ERROR pid=28491 tid=MainThread logger=splunk_ta_o365.modinputs.management_activity pos=utils.py:wrapper:67 | start_time=1537396334 datainput="mgmt_ad_audit" | message="Data input was interrupted by an unhandled exception."
Traceback (most recent call last):
File "/opt/splunk/etc/apps/splunk_ta_o365/bin/splunksdc/utils.py", line 65, in wrapper
return func(*args, **kwargs)
File "/opt/splunk/etc/apps/splunk_ta_o365/bin/splunk_ta_o365/modinputs/management_activity.py", line 88, in run
with app.open_checkpoint(self.name) as checkpoint:
File "/opt/splunk/etc/apps/splunk_ta_o365/bin/splunksdc/collector.py", line 258, in open_checkpoint
checkpoint = LocalKVStore.open_always(fullname)
File "/opt/splunk/etc/apps/splunk_ta_o365/bin/splunksdc/checkpoint.py", line 167, in open_always
indexes = cls.build_indexes(fp)
File "/opt/splunk/etc/apps/splunk_ta_o365/bin/splunksdc/checkpoint.py", line 174, in build_indexes
for flag, key, pos in cls._replay(fp):
File "/opt/splunk/etc/apps/splunk_ta_o365/bin/splunksdc/checkpoint.py", line 103, in _replay
flag, key, _ = umsgpack.unpack(fp)
TypeError: 'int' object is not iterable
I am still receiving the general_audit logs without issue.
... View more