Hi, has anyone had an update on this? I am facing this issue as well on a Windows server.  ... View more

Hi @Wiessiet , Did you get any update from Splunk on this issue yet? I've not been able to open a case yet so wanted to ask if anyone who had a case already opened received any update.  I've observed another strange behaviour of the logs since that even though I receive the 401 client error and no successful ingest messages in the internal logs somehow I still receive the message trace logs for the time window that the API call is being made for like 5:30-6:30 and since the API call is being made repeatedly for the same duration I am getting duplicate logs for that time. So I've temp disabled the input.  ... View more

Just to update - I've been trying the workaround of disabling the input and then enabling the input for Message Trace Logs - initially it seemed to work but now it's not working at all.  Has anyone found any other workaround that seems to work? ... View more

Does Query Window Size have any impact if we change that?  The current was set to 5 mins and I tried changing it to 30 mins while the interval of the api call is 5 mins. ... View more

Hi @bbour53 , Thank you for sharing your temp work-around, I've been trying it out since I'm facing this issue as well but somehow it seems it doesn't work every time.  Can you kindly confirm that the temp workaround only consists of disabling the message trace input from Splunk Add-On for Microsoft 365 via Web GUI and then re-enabling it instantly or is there a wait time until we re-enable the input? Worked for 1-2 times for me and what I was seeing was that it would make 2 api calls after every 300 secs and the first one would fetch messages but the second one would get the 401 client error and now even the frist one isn't getting any messages. ... View more