Here are the changes to the scripts that fix that problem:
In lines 166 to 168 in file splunk_ta_o365/bin/splunk_ta_o365/common/portal.py, add timeout at line 167 like this:
logger.debug(‘Calling management activity API.’, url=url, params=params)
response = session.request(method, url, params=params, timeout=60)
status_code = response.status_code
In lines from 117 - 119 in file splunk_ta_o365/bin/splunk_ta_o365/modinputs/management_activity.py, change the lines 117 and 119 like this:
now = self._now() // 86400 * 86400 + 86400
end_time = datetime.utcfromtimestamp(now)
start_time = end_time - timedelta(days=7)
... View more
plugin is configured to get Office 365 audit logs (Exchange, Sharepoint, Teams, etc.).
The problem is that from time to time it's just stops ingesting some of inputs.
If then input is manually disabled and enabled from a GUI, ingesting is working again.
Internal log shows no errors, just standard messages like: ..success, ..found, ..available content.
Then after a gap there is a message: Loop has been aborted (which is probably according to disabling/enabling input). After that there are standard messages again.
Has anybody had similar problem with this plugin and what could be a solution?
Would you suggest using another app: Splunk Add-on for Microsoft Cloud Services (https://splunkbase.splunk.com/app/3110/#/overview) ?
... View more