I am running the latest beta version of the app given to me by Support and seeing some errors after troubleshooting data that is MIA.
Sample error:
2018-01-11 15:57:16,995 +0000 log_level=ERROR, pid=80730, tid=Thread-6, file=o365_data_collector.py, func_name=_do_safe_index, code_line_no=176 | [input_name="af2a863e-0fb3-462c-80a7-2eddf480771e_Office 365 Management API_Audit.SharePoint" account="TRIM" data="Audit.SharePoint"]Failed to get msg from servers=XXXXXXX, metric=Audit.SharePoint, error=Traceback (most recent call last):
O365GetContentError: [input_name="trim_Office 365 Management API_Audit.SharePoint" account="trim_Splunk_O365_App" data="Audit.SharePoint" proxy_type="http" proxy_rdns="0" proxy_enabled="0" ]Fail to get events of content 20180107230531796018511$20180107230531796018511$audit_sharepoint$Audit_SharePoint, stop this round
... View more