Since from last 1 week index=o365 data is not coming to Splunk.
checked the logs and found the below error
Can anyone help me out to fix this issue.? Thanks in advance!
2020-01-07 14:13:25,110 level=ERROR pid=23567 tid=MainThread logger=splunk_ta_o365.modinputs.management_activity pos=utils.py:wrapper:67 | datainput="o365AuditAD" start_time=1578406405 | message="Data input was interrupted by an unhandled exception."
Traceback (most recent call last):
File "/opt/splunk/etc/apps/splunk_ta_o365/bin/splunksdc/utils.py", line 65, in wrapper
return func(*args, **kwargs)
File "/opt/splunk/etc/apps/splunk_ta_o365/bin/splunk_ta_o365/modinputs/management_activity.py", line 86, in run
Logging.load(config).apply()
File "/opt/splunk/etc/apps/splunk_ta_o365/bin/splunk_ta_o365/common/settings.py", line 65, in load
content = config.load('splunk_ta_o365_settings', stanza='logging')
File "/opt/splunk/etc/apps/splunk_ta_o365/bin/splunksdc/config.py", line 31, in load
content = self._cached_load(path)
File "/opt/splunk/etc/apps/splunk_ta_o365/bin/splunksdc/config.py", line 45, in _cached_load
content = self._fresh_load(path)
File "/opt/splunk/etc/apps/splunk_ta_o365/bin/splunksdc/config.py", line 57, in _fresh_load
elements = self._get(path, query)
File "/opt/splunk/etc/apps/splunk_ta_o365/bin/splunksdc/config.py", line 61, in _get
response = self._service.get(path, **query)
File "/opt/splunk/etc/apps/splunk_ta_o365/bin/3rdparty/splunklib/binding.py", line 303, in wrapper
"Request failed: Session is not logged in.", he)
AuthenticationError: Request failed: Session is not logged in.
↧