Splunk Add-on Builder REST API Test Error - Content purported to be compressed with default but failed to decompress

ejwade — Thu, 19 Mar 2020 20:03:55 GMT

In the Splunk Add-on Builder, I configured a modular input using a REST API to pull data from FortiOS/FortiGate. I tested my REST URL and received the following error message:

[ERROR] - [test] HTTPError reason=HTTP Error Content purported to be compressed with deflate but failed to decompress. when sending request to url=https://x.x.x.x/api/v2/cmdb/firewall/address?with_meta=true&vdom=*&access_token=xxxxxxxxxxxxx method=GET

When I tested the URL in a browser, the JSON comes back fine. Authentication takes place in the URL via the access_token parameter. Any ideas on how to get around this compression error?

Here is the full log:

2020-03-19 19:42:56,347 - test_fortigate_configuration_firewall_addresses - [ERROR] - [test] HTTPError reason=HTTP Error Content purported to be compressed with deflate but failed to decompress. when sending request to url=https://x.x.x.x/api/v2/cmdb/firewall/address?with_meta=true&vdom=*&access_token=xxxxxxxxxxxxx method=GET
Traceback (most recent call last):
  File "/opt/splunk/etc/apps/sherlock_fortigate-config_ta/bin/sherlock_fortigate_config_ta/aob_py3/httplib2/__init__.py", line 455, in _decompressContent
    content = zlib.decompress(content, -zlib.MAX_WBITS)
zlib.error: Error -3 while decompressing data: invalid stored block lengths
During handling of the above exception, another exception occurred:
Traceback (most recent call last):
  File "/opt/splunk/etc/apps/sherlock_fortigate-config_ta/bin/sherlock_fortigate_config_ta/aob_py3/cloudconnectlib/core/http.py", line 224, in _retry_send_request_if_needed
    uri=uri, body=body, method=method, headers=headers
  File "/opt/splunk/etc/apps/sherlock_fortigate-config_ta/bin/sherlock_fortigate_config_ta/aob_py3/cloudconnectlib/core/http.py", line 195, in _send_internal
    uri, body=body, method=method, headers=headers
  File "/opt/splunk/etc/apps/sherlock_fortigate-config_ta/bin/sherlock_fortigate_config_ta/aob_py3/httplib2/__init__.py", line 1957, in request
    cachekey,
  File "/opt/splunk/etc/apps/sherlock_fortigate-config_ta/bin/sherlock_fortigate_config_ta/aob_py3/httplib2/__init__.py", line 1622, in _request
    conn, request_uri, method, body, headers
  File "/opt/splunk/etc/apps/sherlock_fortigate-config_ta/bin/sherlock_fortigate_config_ta/aob_py3/httplib2/__init__.py", line 1592, in _conn_request
    content = _decompressContent(response, content)
  File "/opt/splunk/etc/apps/sherlock_fortigate-config_ta/bin/sherlock_fortigate_config_ta/aob_py3/httplib2/__init__.py", line 466, in _decompressContent
    content,
httplib2.FailedToDecompressContent: Content purported to be compressed with deflate but failed to decompress.
During handling of the above exception, another exception occurred:
Traceback (most recent call last):
  File "/opt/splunk/etc/apps/sherlock_fortigate-config_ta/bin/sherlock_fortigate_config_ta/aob_py3/cloudconnectlib/core/engine.py", line 291, in _send_request
    response = self._client.send(request)
  File "/opt/splunk/etc/apps/sherlock_fortigate-config_ta/bin/sherlock_fortigate_config_ta/aob_py3/cloudconnectlib/core/http.py", line 275, in send
    url, request.method, request.headers, request.body
  File "/opt/splunk/etc/apps/sherlock_fortigate-config_ta/bin/sherlock_fortigate_config_ta/aob_py3/cloudconnectlib/core/http.py", line 229, in _retry_send_request_if_needed
    raise HTTPError('HTTP Error %s' % str(err))
cloudconnectlib.core.exceptions.HTTPError: HTTP Error Content purported to be compressed with deflate but failed to decompress.
2020-03-19 19:42:56,347 - test_fortigate_configuration_firewall_addresses - [INFO] - [test] This job need to be terminated.
2020-03-19 19:42:56,347 - test_fortigate_configuration_firewall_addresses - [INFO] - [test] Job processing finished
2020-03-19 19:42:56,347 - test_fortigate_configuration_firewall_addresses - [INFO] - [test] 1 job(s) process finished
2020-03-19 19:42:56,347 - test_fortigate_configuration_firewall_addresses - [INFO] - [test] Engine executing finished

Re: Splunk Add-on Builder REST API Test Error - Content purported to be compressed with default but failed to decompress

laurie_gellatly — Sat, 28 Mar 2020 11:03:00 GMT

This appears to be telling you that the result being returned is compressed but it can't be deflated.
Are you setting anything in the request that says you accept a compressed result?

Re: Splunk Add-on Builder REST API Test Error - Content purported to be compressed with default but failed to decompress

ejwade — Mon, 30 Mar 2020 16:13:59 GMT

@laurie_gellatly - the request does not have any parameters specifying whether or not to compress. The error message I get from the add-on builder suggests the content claims to be compressed, but the add-on builder's scripts failed to decompress. I think this is mostly likely a bug in the add-on builder, because when I plug the URL into a browser the JSON comes back fine.

topic Re: Splunk Add-on Builder REST API Test Error - Content purported to be compressed with default but failed to decompress in All Apps and Add-ons

Splunk Add-on Builder REST API Test Error - Content purported to be compressed with default but failed to decompress

Re: Splunk Add-on Builder REST API Test Error - Content purported to be compressed with default but failed to decompress

Re: Splunk Add-on Builder REST API Test Error - Content purported to be compressed with default but failed to decompress