search

splunk / azure-functions-splunk

Azure Functions for getting data in to Splunk
Apache License 2.0
30 stars 30 forks source link

Subscription got deleted by mistake #2

Closed SK-QinetiQ closed 2 years ago

SK-QinetiQ commented 2 years ago

Hi,

our Teams call logging had been running without issues for a month or so, then one time the update-subscription got a 404 back from MS Graph - even though the subscription did exist - so the update-subscription function deleted it from the blob store and we stopped getting anymore logs once it expired

here's the logs from Splunk... teams-calls-20211010.csv

is it possible to change the logic of the update-subscription function so it only remove subscriptions from the blob store if they are passed their expiry date? this would stop what looks like a temporary blip in MS Graph leaving you without any logs

cheers, SK

SK-QinetiQ commented 2 years ago

Hi,

I've created a pull request for my fix for the issue. It does 2 things: change the logic of the update-subscription function so it only removes subscriptions from the blob store if they are passed their expiry date; update the delete-subscription function to also remove the subscription from the blob store.

I've been running it in our pre-prod tenant for the last few weeks without issues.

3

cheers, SK

JasonConger commented 2 years ago

Thanks for the PR https://github.com/splunk/azure-functions-splunk/pull/3