I'm having the same issue and I think it has something to do with settings not getting copied properly.
Take a look at this set of messages that keeps occurring over and over again:
2018-01-11 16:42:21,667 +0000 log_level=INFO, pid=15095, tid=MainThread, file=file_monitor.py, func_name=check_changes, code_line_no=48 | Detect /opt/splunk/etc/apps/Splunk_TA_microsoft-cloudservices/local/splunk_ta_ms_o365_server_accounts.conf has changed
2018-01-11 16:42:31,345 +0000 log_level=INFO, pid=15095, tid=Thread-4, file=dispatch_engine.py, func_name=_deploy_global_setting, code_line_no=612 | message="Deploy global setting:account_list$$f69356c0-5d8c-41bd-ab4e-2e575c1baff0_SplunkInt to forwarder:localhost success"
2018-01-11 16:42:40,356 +0000 log_level=INFO, pid=15095, tid=MainThread, file=file_monitor.py, func_name=check_changes, code_line_no=48 | Detect /opt/splunk/etc/apps/Splunk_TA_microsoft-cloudservices/local/splunk_ta_ms_o365_server_accounts.conf has changed
2018-01-11 16:42:49,987 +0000 log_level=INFO, pid=15095, tid=Thread-5, file=dispatch_engine.py, func_name=_deploy_global_setting, code_line_no=612 | message="Deploy global setting:account_list$$f69356c0-5d8c-41bd-ab4e-2e575c1baff0_SplunkInt to forwarder:localhost success"
2018-01-11 16:42:53,992 +0000 log_level=INFO, pid=15095, tid=MainThread, file=file_monitor.py, func_name=check_changes, code_line_no=48 | Detect /opt/splunk/etc/apps/Splunk_TA_microsoft-cloudservices/local/splunk_ta_ms_o365_server_accounts.conf has changed
2018-01-11 16:43:03,566 +0000 log_level=INFO, pid=15095, tid=Thread-2, file=dispatch_engine.py, func_name=_deploy_global_setting, code_line_no=612 | message="Deploy global setting:account_list$$f69356c0-5d8c-41bd-ab4e-2e575c1baff0_SplunkInt to forwarder:localhost success"
2018-01-11 16:43:12,578 +0000 log_level=INFO, pid=15095, tid=MainThread, file=file_monitor.py, func_name=check_changes, code_line_no=48 | Detect /opt/splunk/etc/apps/Splunk_TA_microsoft-cloudservices/local/splunk_ta_ms_o365_server_accounts.conf has changed
2018-01-11 16:43:22,170 +0000 log_level=INFO, pid=15095, tid=Thread-3, file=dispatch_engine.py, func_name=_deploy_global_setting, code_line_no=612 | message="Deploy global setting:account_list$$f69356c0-5d8c-41bd-ab4e-2e575c1baff0_SplunkInt to forwarder:localhost success"
2018-01-11 16:43:31,180 +0000 log_level=INFO, pid=15095, tid=MainThread, file=file_monitor.py, func_name=check_changes, code_line_no=48 | Detect /opt/splunk/etc/apps/Splunk_TA_microsoft-cloudservices/local/splunk_ta_ms_o365_server_accounts.conf has changed
... View more