Mine was caused by browser cache it can impact you in the same browser in both normal and in private /incognito session I've validated by using a different browser and the view appeared in the navigation. Clearing all browser cache and restarting the affected browser fixed this issue. ... View more

This issue first occurred intermittently after upgrading from 9.0.5 to 9.2.1 Splunk Enterprise on a Linux kernel. In place upgrade from 9.2.1 to 9.2.2 didn't fixed the issue neither But commenting out this line as such fixed it. #CFUNCTYPE(c_int)(lambda: None) Also tested on another box with the same issue, I've commented out the line first and then upgraded from 9.2.1 to 9.2.2, the upgrade override the fix, and I have to re-apply the fix again. Definitely raising a Splunk support case for this one 🙂 Thank you! ... View more

The official documentation has been updated with the known issue Reference: https://docs.splunk.com/Documentation/AddOns/released/MSO365/Releasenotes Known issues Version 4.2.1 of the Splunk Add-on for Microsoft Office 365 contains the following, if any, known issues: Customers will experience a delay in event ingestion after v4.2.0 due to KVstore performance on cloud architecture. Date filed Issue number Description 2023-04-13 ADDON-61818 Repeated 401 Client errors when attempting to pull message trace data. Workaround: None Known ... View more

Same, raising a support ticket with Splunk atm. Funny thing is the continuous message trace is still running even though it's constantly throwing 401 errors, but only 2000 events at a time and intermittent using all default settings in the input. Using Azure Enterprise App with ID & Secrets ... View more