Stack Exchange
Getting "Invalid client secret is provided" error while setting up Splunk with Azure Event Hub
I am getting the following error while configuring Splunk with Azure Event Hub.

2021-04-23 10:12:17,141 level=WARNING pid=xxxxxxx tid=Thread-2
logger=azure.eventhub._eventprocessor.event_processor
pos=event_processor.py:_load_balancing:281 | EventProcessor instance
'2ea6353e-ee45-4a4e-b173-5f82ae79707c' of eventhub
'insights-activity-logs' consumer group '$Default'. An error occurred
while load-balancing and claiming ownership. The exception is
EventHubError("Unexpected response '{'error': 'invalid_client',
'error_description': 'AADSTS7000215: Invalid client secret is
provided.\r\nTrace
ID:xxxxxxx-c913-420f-8dfb-5169faed3800\r\nCorrelation ID:
xxxxxxxx-81b2-4436-9d25-13e38ec15d9d\r\nTimestamp: 2021-04-23
02:12:10Z', 'error_codes': [7000215], 'timestamp': '2021-04-23
02:12:10Z', 'trace_id': 'xxxxxxxxx-c913-420f-8dfb-5169faed3800',
'correlation_id': 'xxxxxxxx-81b2-4436-9d25-13e38ec15d9d', 'error_uri':
'https://login.microsoftonline.com/error?code=7000215'}'\nUnexpected
response '{'error': 'invalid_client', 'error_description':
'AADSTS7000215: Invalid client secret is provided.\r\nTrace ID:
xxxxxxx-c913-420f-8dfb-5169faed3800\r\nCorrelation ID:
xxxxxxx-81b2-4436-9d25-13e38ec15d9d\r\nTimestamp: 2021-04-23
02:12:10Z', 'error_codes': [7000215], 'timestamp': '2021-04-23
02:12:10Z', 'trace_id': 'xxxxxxxxx-c913-420f-8dfb-5169faed3800',
'correlation_id': 'xxxxxxxxxx-81b2-4436-9d25-13e38ec15d9d',
'error_uri':
'https://login.microsoftonline.com/error?code=7000215'}'"). Retrying
after 10.408012031827356 seconds

I am referring to the following tutorials:
https://www.splunk.com/en_us/blog/tips-and-tricks/splunking-microsoft-azure-monitor-data-part-1-azure-setup.html
https://www.splunk.com/en_us/blog/tips-and-tricks/splunking-microsoft-azure-monitor-data-part-2-splunk-setup.html
From my understanding, it is that we will have to generate a Azure AD application and set its permission for resource management and here, I am making use of it to enable Splunk to access the activity logs to my Event Hub. I have done setting up an AD application and added the role assignment to the AD application, after that, generated a client secret as mentioned in the tutorial. I am subscribing to Azure for Student, will this be the cause of getting this error as I have limited privileges?

I've faced the same error you described, as it turns out, Splunk Add-on for Microsoft Cloud Services version 4.1.2 has a known issues as described in the release note.
enter image description here
Download version 4.1.1 and force installation solved the issue for me
