Closed jkw117 closed 1 year ago
Is this a clean install or upgrade? I can confirm that this add-on works in both cloud and non-cloud environments. Finally, for Azure AD sign-in data, I would recommend using an event hub instead of this add-on due to throttling limits in the API this add-on uses. More information can be found in the Wiki here => https://github.com/splunk/splunk-add-on-microsoft-azure/wiki/Configure-Azure-Active-Directory-inputs-for-the-Splunk-Add-on-for-Microsoft-Azure
This is a clean install. I did some digging around, in the logs found this:
Introspecting scheme=azure_virtual_network: script running failed (exited with code 1).
Addressed in 4.0.3
I installed the add-on and I'm running 8.1.6 Everytime I hit the configuration/input page I receive this error. Error: Request failed with status code 500 I have yet to find pertinent logs as to why. But several seconds later, the service for splunk fails, crashes completely. I have yet to find a specific direction as to why/logs are empty. I have manually edited the config files. So that's weird.. This is a splunk onsite install. Also I've read conflicting information about whether this can work without it being a splunk cloud install. I am just trying to retrieve signin events that occur in Azure.