Error getting event hub creds: SyntaxError: Unexpected end of JSON input

[karenmcauley]

Hi Sebastus,

We have diagnostics logs and activity logs coming in using this TA. Our issue is that we click on the diagnostics input from Inputs Type, even if we do not edit, we always get the following error:

Error getting event hub creds: SyntaxError: Unexpected end of JSON input

and have to delete the input completely and re-enter. If we do not use a new name for the input, the error will happen again. The effect of adding a new name is that the events start coming back from the beginning, and this takes days to complete and catch up to date.

We have a need for multiple diagnostics inputs and at present this corruption means that this is not possible.

Your advice is much appreciated.

Thanks

Karen

[sebastus]

Karen, Thanks so much for your note. Finally I have an explanation for something that has occurred about 2 times in the past few years. :) The json file that causes the problem is the checkpoint file for the TA. It's located in the normal checkpoint location for TA's in Splunk. Delete it and your problem will go away. That said, the TA isn't written to accommodate more than one of each data input. The primary reason is the checkpoint file. When I wrote it, I didn't include the name of the data input in the name of the checkpoint file. If someone in the community has time and inclination, I'd happily review a PR for the feature. At the moment, the only way to get multiple data inputs of a type (e.g. diagnostics) is to add another HF and install it there. Sorry I don't have better news, Greg

…

On Mon, Nov 11, 2019 at 6:00 PM karenmcauley ***@***.***> wrote: Hi Sebastus, We have diagnostics logs and activity logs coming in using this TA. Our issue is that we click on the diagnostics input from Inputs Type, even if we do not edit, we always get the following error: Error getting event hub creds: SyntaxError: Unexpected end of JSON input and have to delete the input completely and re-enter. If we do not use a new name for the input, the error will happen again. The effect of adding a new name is that the events start coming back from the beginning, and this takes days to complete and catch up to date. We have a need for multiple diagnostics inputs and at present this corruption means that this is not possible. Your advice is much appreciated. Thanks Karen — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#168?email_source=notifications&email_token=AAJ2XLEIQLK6OJLMRQGFXP3QTGMU7A5CNFSM4JLY3Y2KYY3PNVWWK3TUL52HS4DFUVEXG43VMWVGG33NNVSW45C7NFSM4HYPN5BQ>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAJ2XLG2ZEB7VZTDQJIP5YDQTGMU7ANCNFSM4JLY3Y2A> .