Getting "Invalid client secret is provided" error while setting up Splunk with Azure Event Hub

Question

Hi,

I am getting the following error while configuring Splunk with Azure Event Hub.

2021-04-23 10:12:17,141 level=WARNING pid=xxxxxxx tid=Thread-2 logger=azure.eventhub._eventprocessor.event_processor pos=event_processor.py:_load_balancing:281 | EventProcessor instance '2ea6353e-ee45-4a4e-b173-5f82ae79707c' of eventhub 'insights-activity-logs' consumer group '$Default'. An error occurred while load-balancing and claiming ownership. The exception is EventHubError("Unexpected response '{'error': 'invalid_client', 'error_description': 'AADSTS7000215: Invalid client secret is provided.\\r\\nTrace ID:xxxxxxx-c913-420f-8dfb-5169faed3800\\r\\nCorrelation ID: xxxxxxxx-81b2-4436-9d25-13e38ec15d9d\\r\\nTimestamp: 2021-04-23 02:12:10Z', 'error_codes': [7000215], 'timestamp': '2021-04-23 02:12:10Z', 'trace_id': 'xxxxxxxxx-c913-420f-8dfb-5169faed3800', 'correlation_id': 'xxxxxxxx-81b2-4436-9d25-13e38ec15d9d', 'error_uri': 'https://login.microsoftonline.com/error?code=7000215'}'\nUnexpected response '{'error': 'invalid_client', 'error_description': 'AADSTS7000215: Invalid client secret is provided.\\r\\nTrace ID: xxxxxxx-c913-420f-8dfb-5169faed3800\\r\\nCorrelation ID: xxxxxxx-81b2-4436-9d25-13e38ec15d9d\\r\\nTimestamp: 2021-04-23 02:12:10Z', 'error_codes': [7000215], 'timestamp': '2021-04-23 02:12:10Z', 'trace_id': 'xxxxxxxxx-c913-420f-8dfb-5169faed3800', 'correlation_id': 'xxxxxxxxxx-81b2-4436-9d25-13e38ec15d9d', 'error_uri': 'https://login.microsoftonline.com/error?code=7000215'}'"). Retrying after 10.408012031827356 seconds

I am referring to the following tutorials:

https://www.splunk.com/en_us/blog/tips-and-tricks/splunking-microsoft-azure-monitor-data-part-1-azure-setup.html

https://www.splunk.com/en_us/blog/tips-and-tricks/splunking-microsoft-azure-monitor-data-part-2-splunk-setup.html

From my understanding, it is that we will have to generate a Azure AD application and set its permission for resource management and here, I am making use of it to enable Splunk to access the activity logs to my Event Hub. I have done setting up an AD application and added the role assignment to the AD application, after that, generated a client secret as mentioned in the tutorial. I am subscribing to Azure for Student, will this be the cause of getting this error as I have limited privileges?

Answer 1

Hello @Eva Cheong ,

Welcome to the Microsoft Q&A platform.

From the error message it shows as “Invalid client secret is provided”.

Make sure you have copied client secret value and not the client secret ID.

OR

Try to create a new client secret and see if that works.

Hope this helps. Do let us know if you any further queries.

------------

Please don’t forget to Accept Answer and Up-Vote wherever the information provided helps you, this can be beneficial to other community members.