Splunk not Ingesting data via MS Azure Add-On for Splunk

Applicability

Splunk Add-on for Microsoft Azure Splunk Cloud Splunk Enterprise

Description

When inputs were enabled on the add-on no logs were coming in.

The following errors point to misconfiguration from the add-on and permissions from Azure. They can easily be found in:

index="_internal" sourcetype="ta:ms:aad:log" 
source="/opt/splunk/var/log/splunk/ta_ms_aad_MS_AAD_audit.log"

 

HTTPError: 403 Client Error: Forbidden for url: https://graph.microsoft.com/beta/auditLogs/directoryAudits?$orderby=activityDateTime&$filter=activityDateTime+gt+2020-04-21T09:00:00.000000Z+and+activityDateTime+le+2020-06-10T01:10:16.426114ZKeyError: 'access_token'ValueError: Invalid connection stringHTTPError: 403 Client Error: Forbidden for url: https://graph.microsoft.com/beta/users/HTTPError: 403 Client Error: Forbidden for url: https://management.azure.com/subscriptions/13942ec8-31c1-4377-8d87-9344aeff2417/resourcegroups?api-version=2018-05-01

Investigation

The "KeyError: 'access_token'" the message indicates something besides a permission issue.  Either the client ID, client secret, or tenant ID was entered incorrectly.  Or, could be using Azure Gov instead of Azure public.

Resolution

​​​​​Adding the correct credentials fixes the "KeyError: 'access_token'"

After confirming the following permissions are set on the Azure side, the logs will flow (a disable/enable is necessary on the inputs after the permissions are fixed)

Related Links

Splunk Base Splunk Add-on for Microsoft Azure

 

Revision History

Revision	Publish Date	Comments
1.0	29-Sep-2026	Initial Release