topic Re: Syndication Input (RSS/ATOM/RDF) add-on: Why am I getting "INFO Successfully retrieved feed entries, count=0" running a search? in All Apps and Add-ons

Syndication Input (RSS/ATOM/RDF) add-on: Why am I getting "INFO Successfully retrieved feed entries, count=0" running a search?

timpacl — Wed, 09 Dec 2015 23:09:49 GMT

I just installed the Syndication Input add-on on my stand-alone search head and configured the answers.splunk.com/feed/questions.rss input as shown in the example. No data is showing in the dedicated index and running index=_internal sourcetype="syndication_modular_input" shows multiple records with this message:

"INFO Successfully retrieved feed entries, count=0, url=https://answers.splunk.com/feed/questions.rss"

So it says everything is fine, but there is nothing there. I tried both with and without credentials. Inputs.conf stanza in the search app looks like:

[syndication://Splunk Answers]
host = answers.splunk.com
include_only_changed = 1
index = training
interval = 1m
sourcetype = SplunkTraining-Answers
url = https://answers.splunk.com/feed/questions.rss

Re: Syndication Input (RSS/ATOM/RDF) add-on: Why am I getting "INFO Successfully retrieved feed entries, count=0" running a search?

LukeMurphey — Thu, 10 Dec 2015 18:56:56 GMT

It seems like a bug. I have reproduced it locally and am looking fixing it. See http://lukemurphey.net/issues/1134 for details.

I'll post an update here once I find a solution,

Re: Syndication Input (RSS/ATOM/RDF) add-on: Why am I getting "INFO Successfully retrieved feed entries, count=0" running a search?

tp92222 — Fri, 05 Feb 2016 06:32:50 GMT

i am facing same problem..please give us update

thank you!!!!

Re: Syndication Input (RSS/ATOM/RDF) add-on: Why am I getting "INFO Successfully retrieved feed entries, count=0" running a search?

timpacl — Fri, 05 Feb 2016 18:18:08 GMT

Any Update LukeMurphey?

Re: Syndication Input (RSS/ATOM/RDF) add-on: Why am I getting "INFO Successfully retrieved feed entries, count=0" running a search?

LukeMurphey — Sun, 07 Feb 2016 03:20:10 GMT

I tried to reproduce this but it has been working fine for me once I created the "training" index.

Re: Syndication Input (RSS/ATOM/RDF) add-on: Why am I getting "INFO Successfully retrieved feed entries, count=0" running a search?

LukeMurphey — Tue, 09 Feb 2016 18:02:39 GMT

@timpacl, @tp92222: Could both of you provide some information about your Splunk environments (platform, version of Splunk, etc.)? I cannot reproduce this and I'm trying to figure out what is different on my environment than yours.

Re: Syndication Input (RSS/ATOM/RDF) add-on: Why am I getting "INFO Successfully retrieved feed entries, count=0" running a search?

timpacl — Wed, 10 Feb 2016 14:59:03 GMT

Distributed on-prem installation of 6.2 on Windows Server 2012. 5 indexers and 1 search head in 2 US data centers.

Re: Syndication Input (RSS/ATOM/RDF) add-on: Why am I getting "INFO Successfully retrieved feed entries, count=0" running a search?

LukeMurphey — Tue, 29 Sep 2020 08:44:40 GMT

I tried reproducing this on Windows + Splunk 6.2. Still works fine for me. I posted a build that will output a lot more details to the internal log. Would you be willing to run that one? That version will output details on why it is ignoring each RSS entry (do a search for "index=_internal sourcetype=syndication_modular_input").

Re: Syndication Input (RSS/ATOM/RDF) add-on: Why am I getting "INFO Successfully retrieved feed entries, count=0" running a search?

timpacl — Fri, 12 Feb 2016 23:17:34 GMT

I will do it next week. Thanks.

Re: Syndication Input (RSS/ATOM/RDF) add-on: Why am I getting "INFO Successfully retrieved feed entries, count=0" running a search?

tp92222 — Tue, 29 Sep 2020 08:46:13 GMT

config -windows 7 + splunk 6.2

let me know if i miss anything

-installed Syndication Input (RSS/ATOM/RDF) add-on
-enabled app from manage app
-config input with settings shown in below pic

https://www.dropbox.com/s/xw18mz93kplaa6r/syn.png?dl=0

search for Sourcetype=McAfeeTI got no result

i search for "index=_internal sourcetype=syndication_modular_input"

got log as below

2016-02-17 13:37:52,151 INFO Successfully retrieved feed entries, count=0, url=http://tif.mcafee.com/threats.rss

Re: Syndication Input (RSS/ATOM/RDF) add-on: Why am I getting "INFO Successfully retrieved feed entries, count=0" running a search?

tp92222 — Thu, 18 Feb 2016 07:10:47 GMT

@Luke i aslo used new build posted by you above but same result

log-

2016-02-18 12:37:36,167 INFO Successfully retrieved feed entries, count=0, url=http://tif.mcafee.com/threats.rss

Re: Syndication Input (RSS/ATOM/RDF) add-on: Why am I getting "INFO Successfully retrieved feed entries, count=0" running a search?

timpacl — Thu, 18 Feb 2016 13:40:50 GMT

I found that while my server has internet connectivity, when I try to open the RSS directly in the browser it reports that security settings prevent downloading the file. I am working on a solution. I am not sure that corporate policy will allow me to change the security settings.

Re: Syndication Input (RSS/ATOM/RDF) add-on: Why am I getting "INFO Successfully retrieved feed entries, count=0" running a search?

LukeMurphey — Thu, 18 Feb 2016 23:58:40 GMT

@tp92222: that build doesn't include any fixes. Instead, it includes more instrumentation that may help me detect the issue. What do you see when you search for the following:

index=_internal sourcetype="syndication_modular_input" | rex field=_raw "(?<action>((Skipping)|(Including)))" | search count>0 OR action=Including  | table date latest_date title action count

Re: Syndication Input (RSS/ATOM/RDF) add-on: Why am I getting "INFO Successfully retrieved feed entries, count=0" running a search?

LukeMurphey — Thu, 18 Feb 2016 23:59:15 GMT

@tp92222: also, you may try creating another identical input but disabling the option to only include changed entries.

Re: Syndication Input (RSS/ATOM/RDF) add-on: Why am I getting "INFO Successfully retrieved feed entries, count=0" running a search?

tp92222 — Sat, 20 Feb 2016 04:21:23 GMT

i reinstall splunk but this time 6.3 ver .now i am able to see feeds .thank you all for help

Re: Syndication Input (RSS/ATOM/RDF) add-on: Why am I getting "INFO Successfully retrieved feed entries, count=0" running a search?

kabali12345 — Thu, 12 Jan 2017 02:18:10 GMT

i am not getting updates from rss to my splunk instance can u suggest me whole procedure?
Thank you.