I set this app up in our lab on July 31st. Scheduled and ad-hoc meetings worked great right away. Calling never did.
I've finally circled back to look and what I'm seeing at least today is in webex_detailed_call_history.log it's just logging this every time.
2025-12-15 10:59:14,156 log_level=ERROR pid=2869372 tid=MainThread file=base_modinput.py:log_error:317 | [-] Error happened while getting date from webex https://analytics.webexapis.com/v1/cdr_feed?startTime=2025-07-31T00%3A00%3A00Z&endTime=2025-12-15T15%3A54%3A13Z&max=500 API: code: 400 - body: {"errorCode":400,"message":"Invalid input string","errors":[{"errorCode":400,"description":"Start time is older than 720 hours"}],"trackingId":"NA_6135475f-5513-43ed-b502-352a8fb240c7"}
[!] You need to re-configure the account in configuration page
Since obviously the first few days this request would not have involved any data older than 720 hours, I suspect it was initially some other failure but... unfortunately all the old logging has aged out.
I proceeded on these assumptions:
-- that the error returned by webex is right, and the API only accepts requests for data younger than 720 hours
-- that what the TA is saying is right. that re-configuring the account in the TA's configuration page will somehow "kick" the system to behave differently,
However re-configuring the account in the TA's configuraiton page had no effect. I regenerated the secret and re-entered it and restarted Splunk as well for good measure, also no change.
My working theory is that the first month or so it failed for some other reason that has since aged out and rolled out of the logs. And now since the cursor time on the calling side is so old, the TA will just perpetually fail and never recover.
If that theory sounds right to you, in addition to future product improvements here, i have two short term questions:
-- is there any way to manually reset the cursor to get this data coming into my lab box?
-- is there any way that you know of on the webex side to increase the window from 720 hours? This seems weirdly short and customers are going to ask about it.
I am running version 1.0.10 of the TA, on Splunk Enterprise 10.0.0 on a standalone dev box (ubuntu). Thanks in advance for any help !
I set this app up in our lab on July 31st. Scheduled and ad-hoc meetings worked great right away. Calling never did.
I've finally circled back to look and what I'm seeing at least today is in webex_detailed_call_history.log it's just logging this every time.
2025-12-15 10:59:14,156 log_level=ERROR pid=2869372 tid=MainThread file=base_modinput.py:log_error:317 | [-] Error happened while getting date from webex https://analytics.webexapis.com/v1/cdr_feed?startTime=2025-07-31T00%3A00%3A00Z&endTime=2025-12-15T15%3A54%3A13Z&max=500 API: code: 400 - body: {"errorCode":400,"message":"Invalid input string","errors":[{"errorCode":400,"description":"Start time is older than 720 hours"}],"trackingId":"NA_6135475f-5513-43ed-b502-352a8fb240c7"}
[!] You need to re-configure the account in configuration page
Since obviously the first few days this request would not have involved any data older than 720 hours, I suspect it was initially some other failure but... unfortunately all the old logging has aged out.
I proceeded on these assumptions:
-- that the error returned by webex is right, and the API only accepts requests for data younger than 720 hours
-- that what the TA is saying is right. that re-configuring the account in the TA's configuration page will somehow "kick" the system to behave differently,
However re-configuring the account in the TA's configuraiton page had no effect. I regenerated the secret and re-entered it and restarted Splunk as well for good measure, also no change.
My working theory is that the first month or so it failed for some other reason that has since aged out and rolled out of the logs. And now since the cursor time on the calling side is so old, the TA will just perpetually fail and never recover.
If that theory sounds right to you, in addition to future product improvements here, i have two short term questions:
-- is there any way to manually reset the cursor to get this data coming into my lab box?
-- is there any way that you know of on the webex side to increase the window from 720 hours? This seems weirdly short and customers are going to ask about it.
I am running version 1.0.10 of the TA, on Splunk Enterprise 10.0.0 on a standalone dev box (ubuntu). Thanks in advance for any help !