It appears that the management_api access token do not renew during normal operations and requires a restart of the splunk instance to force a renewal. These tokens are short-lived (59 min 59 sec). After which no ms:o365:management sourcetype data are successfully retrieved. Waited several hours before restarting. No data was retrieved until a restart was performed which resumed the data ingestion for this sourcetype.
Has anyone observed this behavior and resolved this successfully?
Is this a known TA bug?