All Apps and Add-ons

Why are the management_api tokens failing to renew in Splunk Add-on for Microsoft Cloud Services?

dimarra
Explorer

It appears that the management_api access token do not renew during normal operations and requires a restart of the splunk instance to force a renewal. These tokens are short-lived (59 min 59 sec). After which no ms:o365:management sourcetype data are successfully retrieved. Waited several hours before restarting. No data was retrieved until a restart was performed which resumed the data ingestion for this sourcetype.

Has anyone observed this behavior and resolved this successfully?

Is this a known TA bug?

Thanks

jconger
Splunk Employee
Splunk Employee

Did you configure a certificate? The certificate it used in the background to refresh API tokens -> https://msdn.microsoft.com/en-us/office-365/get-started-with-office-365-management-apis#configure-an...

For details on configuring a certificate, see this blog (step 29) https://www.splunk.com/blog/2017/07/27/splunking-microsoft-cloud-data-part-1.html

You can check the status of your certificate by going to O365 Troubleshooting tab in the add-on. You should see the text "Auto-generated and verified as valid" or similar depending on whether you used generated certificate or your own certificate.
,Did you configure a certificate? The certificate it used in the background to refresh API tokens -> https://msdn.microsoft.com/en-us/office-365/get-started-with-office-365-management-apis#configure-an...

For details on configuring a certificate, see this blog (step 29) https://www.splunk.com/blog/2017/07/27/splunking-microsoft-cloud-data-part-1.html

You can check the status of your certificate by going to O365 Troubleshooting tab in the add-on. You should see the text "Auto-generated and verified as valid" or similar depending on whether you used generated certificate or your own certificate.

0 Karma
Get Updates on the Splunk Community!

Splunk App Dev Community Updates – What’s New and What’s Next

Welcome to your go-to roundup of everything happening in the Splunk App Dev Community! Whether you're building ...

The Latest Cisco Integrations With Splunk Platform!

Join us for an exciting tech talk where we’ll explore the latest integrations in Cisco + Splunk! We’ve ...

Enterprise Security Content Update (ESCU) | New Releases

In April, the Splunk Threat Research Team had 2 releases of new security content via the Enterprise Security ...