Hi hope someone can help here. ta-ms-loganalytics have suddenly stopped working, i can see below type of errors being logged about the modular inputs  ERROR ModularInputs - Unable to initialize modular input "log_analytics" defined inside the app "TA-ms-loganalytics": Introspecting scheme=log_analytics: script running failed (killed by signal 9: Killed). raise ConnectionError(e, request=request)\nConnectionError: HTTPSConnectionPool(host='127.0.0.1', port=8089): Max retries exceeded with url: /servicesNS/nobody/TA-ms-loganalytics/data/inputs/log_analytics?count=0&output_mode=json (Caused by NewConnectionError('<solnlib.packages.requests.packages.urllib3.connection.VerifiedHTTPSConnection object at 0x7f118318e610>: Failed to establish a new connection: [Errno 111] Connection refused',))\n" any help much appreciated. ... View more

hi i am having issues where some of the sourcetypes are not getting data in splunk from LA,  upon checking some logs i can see below : 2021-03-11 13:07:39,577 ERROR pid=13031 tid=MainThread file=base_modinput.py:log_error:307 | OMSInputName="MyInput" status="400" step="Post Query" response="{"error":{"message":"Response size too large","code":"ResponseSizeError","correlationId":"XXX","innererror":{"code":"ResponseSizeError","message":"Maximum response size of 67108864 bytes exceeded. Actual response Size is 73664723 bytes."}}}" 2021-03-11 13:07:39,577 ERROR pid=13031 tid=MainThread file=base_modinput.py:log_error:307 | Get error when collecting events. Traceback (most recent call last): File "$splunkhome$/etc/apps/TA-ms-loganalytics/bin/ta_ms_loganalytics/modinput_wrapper/base_modinput.py", line 127, in stream_events self.collect_events(ew) File "$splunkhome$/etc/apps/TA-ms-loganalytics/bin/log_analytics.py", line 96, in collect_events input_module.collect_events(self, ew) File "$splunkhome$/etc/apps/TA-ms-loganalytics/bin/input_module_log_analytics.py", line 86, in collect_events for i in range(len(data["tables"][0]["rows"])): UnboundLocalError: local variable 'data' referenced before assignment 2021-03-11 13:08:18,608 ERROR pid=13216 tid=MainThread file=base_modinput.py:log_error:307 | OMSInputName="MyInput2" status="400" step="Post Query" response="{"error":{"message":"Response size too large","code":"ResponseSizeError","correlationId":"XXX","innererror":{"code":"ResponseSizeError","message":"Maximum response size of 67108864 bytes exceeded. Actual response Size is 73136457 bytes."}}}" 2021-03-11 13:08:18,608 ERROR pid=13216 tid=MainThread file=base_modinput.py:log_error:307 | Get error when collecting events. Traceback (most recent call last): File "$splunkhome$/etc/apps/TA-ms-loganalytics/bin/ta_ms_loganalytics/modinput_wrapper/base_modinput.py", line 127, in stream_events self.collect_events(ew) File "$splunkhome$/etc/apps/TA-ms-loganalytics/bin/log_analytics.py", line 96, in collect_events input_module.collect_events(self, ew) File "$splunkhome$/etc/apps/TA-ms-loganalytics/bin/input_module_log_analytics.py", line 86, in collect_events for i in range(len(data["tables"][0]["rows"])): UnboundLocalError: local variable 'data' referenced before assignment Am i hitting any limitation ? if so, any way to overcome this ? any suggestions appreciated... @jkat54  ... View more

Hi i have installed  Splunk Add-on for Microsoft Cloud Services in my heavy forwarder instance, and the app has been working as expected, with 7-8 inputs configured (storage account inputs). Now i am trying to add a new storage account where the container resides in a sub-folder. My existing inputs folder pattern in Azure(which works fine) : Storage account -> containers -> <my_container_name> inputs.conf as below [mscs_storage_blob://myfirstblob] account = my_account_name blob_mode = append collection_interval = 300 container_name = <my_container_name> index = index1 sourcetype = mscs:storage:blob:myfirstblob python.version = python2 I Need help with configure this patter path : Storage account -> containers -> <my_folder> -> <my_container_name> i have tried multiple patterns like below but does not seems to be working inputs.conf [mscs_storage_blob://myfirstblob] account = my_account_name blob_mode = append collection_interval = 300 container_name = containers/<my_folder>/<my_container_name> (OR this as well /<my_folder>/<my_container_name>) index = index1 sourcetype = mscs:storage:blob:myfirstblob python.version = python2 ... View more