topic Syndication Input (RSS/ATOM/RDF) Add-On in All Apps and Add-ons

Syndication Input (RSS/ATOM/RDF) Add-On

paulbannister — Mon, 18 Jan 2021 11:55:53 GMT

Since updating to 8.1.1 on our Heavy Forwarder we've been seeing the below error message within the internal logs of the add-on, has anyone else experienced this and aware of a fix?

Traceback (most recent call last): File "/opt/splunk/etc/apps/syndication/bin/modular_input.zip/modular_input/modular_input_base_class.py", line 1095, in execute self.do_run(in_stream, log_exception_and_continue=True) File "/opt/splunk/etc/apps/syndication/bin/modular_input.zip/modular_input/modular_input_base_class.py", line 976, in do_run self.run(stanza, cleaned_params, input_config) File "/opt/splunk/etc/apps/syndication/bin/syndication.py", line 383, in run if last_entry_date_retrieved is not None and last_entry_date_retrieved > last_entry_date: TypeError: '>' not supported between instances of 'time.struct_time' and 'NoneType'

@LukeMurphey

Re: Syndication Input (RSS/ATOM/RDF) Add-On

richgalloway — Mon, 18 Jan 2021 13:56:29 GMT

Run the Splunk Upgrade Readiness app on that app to verify it is Python3-compatible. Install a newer version of the app, if there is one.

Re: Syndication Input (RSS/ATOM/RDF) Add-On

paulbannister — Mon, 18 Jan 2021 15:41:57 GMT

Hi Rich,

Latest available version of the App has been installed and is allegedly compatible with 8.1, we've just been through all the readiness and updates for our environment and nothing came up flagged for the app

Many Thanks

Paul

Re: Syndication Input (RSS/ATOM/RDF) Add-On

humayo — Tue, 02 Mar 2021 19:05:38 GMT

Was there a resolution to this? We have the same error with Splunk Enterprise 8.1.0.1 and the latest Syndication app (1.2.4)

Re: Syndication Input (RSS/ATOM/RDF) Add-On

paulbannister — Wed, 17 Mar 2021 10:32:53 GMT

No official resolution as far as I can see, some of our feeds were happy once they were deleted and recreated fresh but not all got fixed in this way, thankfully those ones weren't crucial feeds

Re: Syndication Input (RSS/ATOM/RDF) Add-On

Chikuwa — Sun, 15 Aug 2021 08:04:13 GMT

You can fix this by editing syndication/bin/syndication.py as follows:

170c170 < latest_date = None --- > latest_date = time.gmtime(0) 343c343 < last_entry_date = None --- > last_entry_date = time.gmtime(0) 347c347 < last_entry_date_retrieved = None --- > last_entry_date_retrieved = time.gmtime(0) 383c383 < if last_entry_date_retrieved is not None and last_entry_date_retrieved > last_entry_date: --- > if last_entry_date_retrieved !=0 and last_entry_date_retrieved > last_entry_date:

Re: Syndication Input (RSS/ATOM/RDF) Add-On

Mark_D61 — Wed, 15 Sep 2021 22:23:49 GMT

Has anyone found that the fix mentioned by @Chikuwa doesn't work?

After changing out the lines in syndication.py, and restarting Splunk, it fails to load the Addon.

Does anyone have another solution?

I'm using Splunk 8.2.1

*** I want to update this reply***

I deleted all the inputs (2 all up, the first one for another site worked). I then re-added the input for the one that was not working as the only input for syndication, and now it works.

Re: Syndication Input (RSS/ATOM/RDF) Add-On

Chikuwa — Thu, 16 Sep 2021 06:35:06 GMT

@Mark_D61What version of the app do you use. The version I mentioned is 1.2.4.

Were error messages changed after editing syndication.py?

Let me see the error by executing the search below.

index=_internal sourcetype=syndication_modular_input

Re: Syndication Input (RSS/ATOM/RDF) Add-On

s2233 — Wed, 05 Jan 2022 18:44:12 GMT

@Mark_D61 can you clarify what you did to get the add-on to appear again? It seems to disappear whenever I attempt to modify syndication.py and restart Splunk.