If you receive the following error in your Storage Blob input:Ī: The condition specified using HTTP conditional header(s) is not met. Please refer to Storage Blob input configuration manual for more details about the Read Timeout parameter.Įrror message: : The condition specified using HTTP conditional header(s) is not met This is because it increases the value to the point which works best without causing the read timeout error. If Read Timeout parameter is set to a very small value, the input might start to report the read timeout error, which will cause a data ingestion issue. As a workaround to this API issue, Input configuration includes the Read Timeout parameter which can be used to set lower read timeout value (instead of 80000 seconds) to resume data collection sooner. To address this, the SDK includes 80000 seconds (around 22 hours) read timeout so that it fails and retries the same request, resuming the data collection. If the Storage Blob input data ingestion gets stuck, it may occur when the API service accepts the request but fails to return a response, causing the thread to get stuck until a response is received. Add the comma separated metric namespaces in the namespaces field while configuring the input.Īzure Storage Blob Input - Data Ingestion stuck issue If you repeatedly face the Rate Limiting error, try to resolve it by merging the multiple metrics inputs to one input. Check for error messages in the input log files for more information on possible ways to optimize KQL Query.Īzure Metrics Input - 'code': 'RateLimiting' Error If configured KQL Query has results that exceed the default API limits, then partial events will be returned and ingested into Splunk. If you are seeing "PartialError" in logs, then a possible cause is that the Azure Log Analytics workspace API used in the input has limits on the maximum number of events and maximum size of responses returned from the API. If the Event hub input is using the old proxy/account configuration, turn off and then turn on the Event Hub input so the new configurations are reloaded.Īzure KQL Log Analytics Input - PartialError Increase intervals in proportion to the number of inputs you have configured in your deployment.Įvent Hub input using the old proxy or account configuration even if the configurations are changed from UI.Navigate to your Task Manager, and verify a high amount of python.exe tasks.If your Microsoft Cloud Services deployment experiences a CPU spike after you install and configure the Splunk Add-on for Microsoft Cloud Services, your deployment might have too many inputs enabled and too short an interval in the code. Scripted inputs causing a spike in CPU percentage See nf in the Splunk Enterprise Admin manual. To increase the character limit beyond 10K bytes in a single line, use the truncate setting in the nf file to define the size of the line. If the maximum number of lines in a file exceeds the default, change the max_events setting in the nf file under the file's source type stanza. If the number of lines in an event exceeds this limit, then the Splunk software truncates the event. The default number of maximum lines for any event in the Splunk software is 256. If you can't get data, check that you are using the correct Account Name and Account Secret.If you can't get data in using Azure Storage Table, Azure Storage Blob and Azure Virtual Machine Metrics: If you have no errors and cannot collect data, remove the checkpoint file and try again.Use the search in the Accessing logs of Azure inputs table to check for errors.See Grant the Active Directory Application Read Access. If you can't get data, check that you are using the correct Client ID, Client Secret, and Tenant ID. If you can't get data in using Azure Resource and Azure Audit, follow these steps: $SPLUNK_HOME/var/lib/splunk/modinputs/mscs_azure_audit $SPLUNK_HOME/var/lib/splunk/modinputs/mscs_storage_blob $SPLUNK_HOME/var/lib/splunk/modinputs/mscs_storage_table The following data sources are stored in the following directories: Splunk_ta_microsoft-cloudservices_azure_resource.log Splunk_ta_microsoft-cloudservices_storage_blob.log Index=_internal sourcetype="mscs:storage: Splunk_ta_microsoft-cloudservices_storage_table.logĪzure Storage Table and VIrtual Machine Metrics channel log The following table describes the logs for different inputs: For additional resources, see Support and resource links for add-ons in Splunk Add-ons. Troubleshoot the Splunk Add-on for Microsoft Cloud Servicesįor helpful troubleshooting tips that you can apply to all add-ons, see Troubleshoot add-ons in Splunk Add-ons.
0 Comments
Leave a Reply. |
Details
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |