We were successfully ingesting O365 management logs using the Splunk O365 add-on. We noticed a drop in events and a really small number of events being forwarded for a day after the drop. After that events stopped coming in completely. This was a working inputs with logs coming in as expected. No change to a configuration was made to Splunk or O365 whatsoever.   Currently we can see the following error in Splunk each time the input is run. The error appears after the input successfully acquires the access token and calls the management API.       2020-11-30 12:59:34,992 level=ERROR pid=27098 tid=MainThread logger=splunk_ta_o365.modinputs.management_activity pos=utils.py:wrapper:67 | datainput=b'O365_audit_general' start_time=1606741174 | message="Data input was interrupted by an unhandled exception." Traceback (most recent call last): File "/opt/splunk/etc/apps/splunk_ta_o365/bin/splunksdc/utils.py", line 65, in wrapper return func(*args, **kwargs) File "/opt/splunk/etc/apps/splunk_ta_o365/bin/splunk_ta_o365/modinputs/management_activity.py", line 102, in run executor.run(adapter) File "/opt/splunk/etc/apps/splunk_ta_o365/bin/splunksdc/batch.py", line 47, in run for jobs in delegate.discover(): File "/opt/splunk/etc/apps/splunk_ta_o365/bin/splunk_ta_o365/modinputs/management_activity.py", line 126, in discover if not subscription.is_enabled(session): File "/opt/splunk/etc/apps/splunk_ta_o365/bin/splunk_ta_o365/common/portal.py", line 151, in is_enabled response = self._perform(session, 'GET', '/subscriptions/list') File "/opt/splunk/etc/apps/splunk_ta_o365/bin/splunk_ta_o365/common/portal.py", line 169, in _perform return self._request(session, method, url, kwargs) File "/opt/splunk/etc/apps/splunk_ta_o365/bin/splunk_ta_o365/common/portal.py", line 181, in _request raise O365PortalError(response) File "/opt/splunk/etc/apps/splunk_ta_o365/bin/splunk_ta_o365/common/portal.py", line 26, in __init__ message = str(response.status_code) + ':' + payload TypeError: can only concatenate str (not "bytes") to str       The same error appears for all add-on inputs (status, message, audit, sharepoint etc.)   Any idea what the problem might be? ... View more

As in title, I was wondering if it is possible to use the same certificate on Heavy forwarders for access to the web UI and as a server cert for server forwarding. looking at here: https://docs.splunk.com/Documentation/Splunk/8.0.1/Security/Howtogetthird-partycertificates and here: https://docs.splunk.com/Documentation/Splunk/8.0.2/Security/Getthird-partycertificatesforSplunkWeb The process for creating the CSRs is a bit different. In the web certificate the password is removed from the key before creating the CSR. would that make any difference on the final certificate? would I be able to use it for both functions? Is there something that I might need to be aware of? ... View more

I am trying to on board data from Azure AD and O365 to Splunk cloud. I have both the Splunk add-on for Microsoft Cloud services and the Splunk add-on for Microsoft Office 365 installed on the IDM. I am in the process of configuring the Azure portal but looking at the docs (O365 and MS cloud Services) both point to MS docs (MS O365 and MS cloud Services) and the process described over there is not exactly what is described on the Splunk Docs. More specifically I am not sure if I need a "redirect URL" as stated in the MS docs and also I am not sure where to find that. It looks like it might be needed for O365 and there was a way to get it through the MS cloud Services add-on however this has since been updated and it's no longer there and O365 data should be forwarded from the O365 add-on which doesn't provide it either. I managed to write down a few steps for both Azure and O365 configuration on the Azure portal but I am looking for some feedback on if I am understanding everything correctly and if this is al that is needed to be done. Here are the steps: ... View more