×

Are you a member of the Splunk Community?

Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
Sarvesh_Fenix
New Member
Member since: ‎05-12-2025
‎05-13-2025
Community Statistics
Posts 2
Solutions 0
Karma Given 0
Karma Received 0
Member Since ‎05-12-2025
Activity Feed
View All

Re: sourcetype=azure:aad:signin ?

by in All Apps and Add-ons
‎05-13-2025 05:17 AM
‎05-13-2025 05:17 AM
I have tried with below suggestions, but still not working.   Though the throttling error and timeout errors are cleaned. I have checked the permission also on Azure for the client we are using. Now error logs are: 05-13-2025 12:07:30.690 +0000 INFO ExecProcessor [326053 ExecProcessor] - Removing status item "/opt/splunk/etc/apps/TA-MS-AAD/bin/MS_AAD_signins.py (MS_AAD_signins://SignInDetails) (isModInput=yes)   05-13-2025 06:41:33.207 +0000 ERROR UiAuth [46016 TcpChannelThread] - Request from 122.169.17.168 to "/en-US/splunkd/__raw/servicesNS/nobody/TA-MS-AAD/TA_MS_AAD_MS_AAD_signins/SignInDetails?output_mode=json" failed CSRF validation -- expected key "[REDACTED]8117" and header had key "10508357373912334086"   ... View more

sourcetype=azure:aad:signin ?

by in All Apps and Add-ons
‎05-12-2025 02:14 PM
‎05-12-2025 02:14 PM
Hello Splunkers,   Need help/reference to onboard  Azure SignIn logs to Splunk? i am trying with Splunk Add for Microsoft Azure (Splunk Add on for Microsoft Azure | Splunkbase) But unable to do so,  getting below error: 2025-05-12 13:04:13,042 log_level=ERROR pid=319128 tid=MainThread file=base_modinput.py:log_error:317 | Get error when collecting events. Traceback (most recent call last): File "/opt/splunk/etc/apps/TA-MS-AAD/lib/splunktaucclib/modinput_wrapper/base_modinput.py", line 141, in stream_events self.collect_events(ew) File "/opt/splunk/etc/apps/TA-MS-AAD/bin/azure_metrics.py", line 141, in collect_events resources = az_resource_graph.get_resources_by_query(helper, access_token, query, subscription_id.split(","), environment, resources=[]) File "/opt/splunk/etc/apps/TA-MS-AAD/bin/ta_azure_utils/resource_graph.py", line 63, in get_resources_by_query raise e File "/opt/splunk/etc/apps/TA-MS-AAD/bin/ta_azure_utils/resource_graph.py", line 48, in get_resources_by_query r.raise_for_status() File "/opt/splunk/etc/apps/TA-MS-AAD/lib/requests/models.py", line 1024, in raise_for_status raise HTTPError(http_error_msg, response=self) requests.exceptions.HTTPError: 429 Client Error: Too Many Requests for url: https://management.azure.com/providers/Microsoft.ResourceGraph/resources?api-version=2019-04-01 05-12-2025 18:25:07.429 +0000 ERROR TcpInputProc [1731515 FwdDataReceiverThread-0] - Error encountered for connection from src=127.0.0.1:42076. error:140890C7:SSL routines:ssl3_get_client_certificate:peer did not return a certificate   05-12-2025 13:04:13.134 +0000 ERROR ExecProcessor [326053 ExecProcessor] - message from "/opt/splunk/bin/python3.9 /opt/splunk/etc/apps/TA-MS-AAD/bin/azure_metrics.py" 429 Client Error: Too Many Requests for url: https://management.azure.com/providers/Microsoft.ResourceGraph/resources?api-version=2019-04-01 - Traceback (most recent call last): File "/opt/splunk/etc/apps/TA-MS-AAD/lib/splunktaucclib/modinput_wrapper/base_modinput.py", line 141, in stream_events self.collect_events(ew) File "/opt/splunk/etc/apps/TA-MS-AAD/bin/azure_metrics.py", line 141, in collect_events resources = az_resource_graph.get_resources_by_query(helper, access_token, query, subscription_id.split(","), environment, resources=[]) File "/opt/splunk/etc/apps/TA-MS-AAD/bin/ta_azure_utils/resource_graph.py", line 63, in get_resources_by_query raise e File "/opt/splunk/etc/apps/TA-MS-AAD/bin/ta_azure_utils/resource_graph.py", line 48, in get_resources_by_query r.raise_for_status() File "/opt/splunk/etc/apps/TA-MS-AAD/lib/requests/models.py", line 1024, in raise_for_status raise HTTPError(http_error_msg, response=self) requests.exceptions.HTTPError: 429 Client Error: Too Many Requests for url: https://management.azure.com/providers/Microsoft.ResourceGraph/resources?api-version=2019-04-01 During handling of the above exception, another exception occurred: Traceback (most recent call last): File "/opt/splunk/etc/apps/TA-MS-AAD/lib/splunklib/modularinput/script.py", line 67, in run_script self.stream_events(self._input_definition, event_writer) File "/opt/splunk/etc/apps/TA-MS-AAD/lib/splunktaucclib/modinput_wrapper/base_modinput.py", line 150, in stream_events raise RuntimeError(str(e)) RuntimeError: 429 Client Error: Too Many Requests for url: https://management.azure.com/providers/Microsoft.ResourceGraph/resources?api-version=2019-04-01   TIA,     ... View more
Labels
Contact Me
Online Status
Offline
Date Last Visited
‎05-13-2025 05:15 AM