Is the Splunk Add-on for Microsoft Cloud Services or Splunk Add-on for Azure Support collect Azure China?

[Jianming]

Hi everyone:

Splunk Add-on for Microsoft Cloud Services or Splunk Add-on for Azure Support collect Aure China? 

1. Splunk Add-on for Azure  

     i create a new account. and create new input.

    but see the log report error

    cat ta_ms_aad_azure_virtual_network.log
2023-06-14 10:32:07,118 INFO pid=4938 tid=MainThread file=setup_util.py:log_info:142 | Log level is not set, use default INFO
2023-06-14 10:32:07,118 INFO pid=4938 tid=MainThread file=setup_util.py:log_info:142 | Proxy is not enabled!
2023-06-14 10:32:08,558 ERROR pid=4938 tid=MainThread file=base_modinput.py:log_error:316 | Get error when collecting events.
Traceback (most recent call last):
File "/opt/splunk/etc/apps/TA-MS-AAD/lib/splunktaucclib/modinput_wrapper/base_modinput.py", line 140, in stream_events
self.collect_events(ew)
File "/opt/splunk/etc/apps/TA-MS-AAD/bin/azure_virtual_network.py", line 212, in collect_events
raise RuntimeError("Unable to obtain access token. Please check the Client ID, Client Secret, and Tenant ID")
RuntimeError: Unable to obtain access token. Please check the Client ID, Client Secret, and Tenant ID

2.  Splunk Add-on for Microsoft Cloud Services 

       when i was created azure app account, report  Account authentication failed. Please check your                credentials and try again

Who know, the two add-on is support Azure China or not ?

thanks 

[tarungupta0311]

To Pull China event Hub data, Splunk Add-on for Microsoft Cloud Services requires 2 changes:-
1st * Edit $SPLUNK_HOME/etc/apps/Splunk_TA_microsoft-cloudservices/bin/splunk_ta_mscs_rh_azureaccount.py
* Around line 88, we need to add a check for the Azure China region

if account_class_type == str(AccountClassType.GOVCLOUD_ACCOUNT):
self.cloud_environment = azure_cloud.AZURE_US_GOV_CLOUD
elif account_class_type == str(AccountClassType.CHINA_ACCOUNT):
self.cloud_environment = azure_cloud.CHINA_ACCOUNT
else:
self.cloud_environment = azure_cloud.AZURE_PUBLIC_CLOUD

2nd to map the event hubs $SPLUNK_HOME/etc/apps/Splunk_TA_microsoft-cloudservices/local
Create “mscs_azure_accounts.conf”

[ProvideName]
account_class_type = 3
client_id = ******
client_secret = ******
tenant_id = ******

[Jianming]

modify this one is error: self.cloud_environment = azure_cloud.CHINA_ACCOUNT

the py file:  from msrestazure import azure_cloud,   s

so this is correct : self.cloud_environment = azure_cloud.AZURE_CHINA_CLOUD

but still error:

configuration inputs  such as azure resource

the log report

the api link still use azure_public_cloud. 

[tarungupta0311]

I am also getting an Authentication error -