Hello Jacob, I will have a look at that app. It is pretty old, although it may be able to give me some idea for how to get OneNote data into Splunk. ... View more

Regarding the TA for SCOM, the inputs need to finish before firing again. The performance input is particularly verbose, as the documentation says to expect up to 20 minutes for the performance input to finish collecting data the first time that it is fired. https://docs.splunk.com/Documentation/AddOns/latest/MSSCOM/Configureinputs If any of the inputs for this TA do not finish prior to being called to run again, you will see the error message referenced in the first post of this page. I can say that I have seen the performance input take up to 40 minutes to finish its initial pull of data with subsequent pulls taking up to 20 minutes depending on the amount of data being collected. Regards, Hans ... View more

I just resolved a case where the customer was having this same error message. The issue was that they could not collect any data with the TA for Salesforce 1.0 and Splunk Enterprise 7.1 AMI. I noticed that the account name that the customer created within the context of the TA was the same as the username being used to access Salesforce. We made sure to enter a different account name than the one being used as the username to access Salesforce and that there were no special characters present. Previously, the customer had configured johndoe@blahblah.com as the account name while this was also the username of the Salesforce account. Remove any special characters from the account name and make sure that the account name is different than the username. Regards, Hans Edit: I have also seen this error occur when a customer splits the add-on for Salesforce package into multiple folders. The TA is looking for some configuration in a particular place, and it throws the above referenced error when it cannot find whatever configuration it was looking for. ... View more