Splunk Add-on for GitHub data is not getting ingested

Applicability

Description

The Splunk Add-on for Github has been successfully configured but is experiencing an issue while ingesting Github user logs and audit logs.If received an error message stating,

"Bad Credentials" and Could not fetch user log data. Make sure required scopes are provided to access token. 

Resolution

• Verify the Personal Access Token (PAT)
  Ensure the PAT being used is correct and valid.
  If unsure, generate a new token from Github by following these steps:
  Step 1.  Go to Github Settings > Developer Settings > Personal Access Tokens.
  Step 2. Select Tokens (Classic) or the appropriate method.
  Step 3. Generate a new token with the necessary scopes.
  
  Log in to Splunk and update the configuration with the new token:
  Step 1. Navigate to the Splunk Add-on for Github > Configuration tab.
  Step 2. Replace the existing token with the new one.
  Step 3. Save the changes.
  
  
• Ensure Required Scopes are Granted
  Grant the following scopes for the token to collect user logs and audit logs:
  Step 1. admin: org (for organizational audit log data).
  Step 2. Read: org (to read organization details).
  Step 3. user (to access user data).
  Step 4. repo (if repository data is required).
  Step 5. audit_log (specific to audit log access).
  
  
• Test API Connectivity
   Use curl to test the Github API using the new token to confirm it works:
  

curl -H "Authorization: token <your-token>" 

•   Network Connectivity
  Ensure that the Splunk instance can connect to Github’s API endpoints:
  Step 1. Test the API URL using a tool like curl or a browser.
  Step 2. Verify that firewalls, proxies, or VPNs are not blocking outgoing requests.
  
  
•  Restart the Splunk Add-on
   Step 1. Restart the Splunk Add-on for Github to ensure the new token is used in the next data collection cycle.
  
  
• Verify API Rate Limits
  Step 1. Github imposes rate limits on API calls, So check if the account is hitting the limit:
  Step 2. The Github Cloud Audit Log API allows 1750 API calls in an hour, and each API call allows 100 records to be fetched.
  Srep 3. If the limit is exhausted, the user would have to wait till the API limit resets.
  
  
• Upgrade the Addon
  Step 1. If the addon is not in the latest version, please upgrade the Splunk Add-on for Github to ensure it is up-to-date.

Related Links

GitHub Troubleshoot

Reviewing-the-audit-log-for-your-organization

Managing-your-personal-access-tokens