Getting "Invalid client secret is provided" error while setting up Splunk with Azure Event Hub

Eva Cheong 51 Reputation points
2021-04-26T01:20:17.737+00:00

Hi,

I am getting the following error while configuring Splunk with Azure Event Hub.

2021-04-23 10:12:17,141 level=WARNING pid=xxxxxxx tid=Thread-2 logger=azure.eventhub._eventprocessor.event_processor pos=event_processor.py:_load_balancing:281 | EventProcessor instance '2ea6353e-ee45-4a4e-b173-5f82ae79707c' of eventhub 'insights-activity-logs' consumer group '$Default'. An error occurred while load-balancing and claiming ownership. The exception is EventHubError("Unexpected response '{'error': 'invalid_client', 'error_description': 'AADSTS7000215: Invalid client secret is provided.\\r\\nTrace ID:xxxxxxx-c913-420f-8dfb-5169faed3800\\r\\nCorrelation ID: xxxxxxxx-81b2-4436-9d25-13e38ec15d9d\\r\\nTimestamp: 2021-04-23 02:12:10Z', 'error_codes': [7000215], 'timestamp': '2021-04-23 02:12:10Z', 'trace_id': 'xxxxxxxxx-c913-420f-8dfb-5169faed3800', 'correlation_id': 'xxxxxxxx-81b2-4436-9d25-13e38ec15d9d', 'error_uri': 'https://login.microsoftonline.com/error?code=7000215'}'\nUnexpected response '{'error': 'invalid_client', 'error_description': 'AADSTS7000215: Invalid client secret is provided.\\r\\nTrace ID: xxxxxxx-c913-420f-8dfb-5169faed3800\\r\\nCorrelation ID: xxxxxxx-81b2-4436-9d25-13e38ec15d9d\\r\\nTimestamp: 2021-04-23 02:12:10Z', 'error_codes': [7000215], 'timestamp': '2021-04-23 02:12:10Z', 'trace_id': 'xxxxxxxxx-c913-420f-8dfb-5169faed3800', 'correlation_id': 'xxxxxxxxxx-81b2-4436-9d25-13e38ec15d9d', 'error_uri': 'https://login.microsoftonline.com/error?code=7000215'}'"). Retrying after 10.408012031827356 seconds

I am referring to the following tutorials:

https://www.splunk.com/en_us/blog/tips-and-tricks/splunking-microsoft-azure-monitor-data-part-1-azure-setup.html

https://www.splunk.com/en_us/blog/tips-and-tricks/splunking-microsoft-azure-monitor-data-part-2-splunk-setup.html

From my understanding, it is that we will have to generate a Azure AD application and set its permission for resource management and here, I am making use of it to enable Splunk to access the activity logs to my Event Hub. I have done setting up an AD application and added the role assignment to the AD application, after that, generated a client secret as mentioned in the tutorial. I am subscribing to Azure for Student, will this be the cause of getting this error as I have limited privileges?

Azure Event Hubs
Azure Event Hubs
An Azure real-time data ingestion service.
637 questions
{count} votes

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.