I cannot determine the cause of an error I am getting when attempting to search for logs in Splunk Cloud. An example of the error I am getting is here:
2020-07-26 16:11:46,518 log_level=ERROR pid=11016 tid=MainThread file="ga.py" function="run" line_number="306" version="GSuiteForSplunk.v1.4.2.b310" {'timestamp': 'Sun, 26 Jul 2020 16:11:46 +0000', 'log_level': 'ERROR', 'msg': "'NoneType' object has no attribute 'tb_frame'", 'exception_type': "<class 'AttributeError'>", 'exception_arguments': "'NoneType' object has no attribute 'tb_frame'", 'filename': 'ga.py', 'exception_line': 131}
I have read through two relevant posts in this forum:
- https://community.splunk.com/t5/All-Apps-and-Add-ons/Splunk-App-for-GSuite-error/m-p/388181
- https://community.splunk.com/t5/All-Apps-and-Add-ons/NoneType-object-has-no-attribute-tb-frame/m-p/3...
Both point me to an issue with installing the apps on HFW or SH or IA. I am using Splunk Cloud, with IDM, and no HFW. I am not aware that I need a Heavy Forwarder; maybe that's my mistake. The G Suite apps/add-ons were installed on the Search Head and the IDM, and I configured the inputs on the IDM only. Still, the error persists. Another thing that may be worth noting is that the errors I am seeing are indexed in the "main" indexers, not in the gsuite index I created.
Environment description:
- Splunk Cloud (with SH and IDM), version 8.0.2001.1
- Installed (by Splunk Support Team) two apps on IDM: GSuiteForSplunk Input Add-On (cannot tell which version - it was installed by Splunk Support Team yesterday), and G Suite For Splunk (version 1.4.2.b310)
- Installed (by Splunk Support Team) one app on SH: G Suite For Splunk
Configured GSuiteForSplunk Input Add-on on IDM:
- Created a SuperAdmin on G Suite
- Using the SuperAdmin account created above, created a Project on Google APIs & Services (https://console.developers.google.com/)
- On said project, created an OAuth2 Client ID, and authorized Desktop App Type with the scope (allowing Admin SKD, G Suite Alert Center, and Google Drive API)
- On Splunk Cloud SH, created a new index named gsuite
- On GSuiteForSplunk Input Add-On (on SplunkCloud IDM), entered domain, Client ID, and Client Secret, and authenticated against Google, and retrieve token, and entered token into GSuiteForSplunk Input Add-On (on SplunkCloud IDM); saved
- On GSuiteForSplunk Input Add-On (on SplunkCloud IDM) > clicked on Create New G Suite Input, I set interval for 60 (seconds), Index to gsuite, and None for Proxy Name. For Extra Configuration, I entered {} (per note on the page to leave this variable as default)
- On GSuiteForSplunk Input Add-On (on SplunkCloud IDM) > G Suite > I selected th checkboxes for Activity - All, Activity - Admin, Activity - Drive, and Activity - Login, and confirmed that the Index was set to gsuite.
- On GSuiteForSplunk Input Add-On (on SplunkCloud IDM) > Credentials, I see an entry named IA-GSuiteForSplunk with the username of the domain I entered above, and a redacted password.
- On G Suite App for Splunk (on SplunkCloud SH) > Application Configuration > I see a Save button, with the correct variable value for the index. I do not see any entries under the Credentials tab, but I don't think this is an issue.
If I search (on the SH) for logs, I see many errors (much like the ones I posted above). Under Application Health on the SH, I see (under Internal Log Errors), I see the same error multiple times (sourcetype="ga_modularinput", and message="'NoneType' object has no attribute 'tb_frame'").
What am I doing wrong here?
Thank you for your time.