topic Re: Splunk_TA_New_Relic Insight not ingesting data in All Apps and Add-ons

Splunk_TA_New_Relic Insight not ingesting data

a_hadiwidjaja — Mon, 09 Nov 2020 23:45:39 GMT

Hi all,

I have installed Splunk_TA_New_Relic v2.2.0 and configured the NR Insight Input. I did not use HTTP proxy and I could see the following error in the TA logs:

AttributeError: module 'socks' has no attribute 'PROXY_TYPE_HTTP_NO_TUNNEL'

'http_no_tunnel': socks.PROXY_TYPE_HTTP_NO_TUNNEL,

File "/opt/splunk/etc/apps/Splunk_TA_New_Relic/bin/splunk_ta_new_relic/aob_py3/cloudconnectlib/core/http.py", line 26, in <module>

from .http import HttpClient

File "/opt/splunk/etc/apps/Splunk_TA_New_Relic/bin/splunk_ta_new_relic/aob_py3/cloudconnectlib/core/engine.py", line 6, in <module>

from .engine import CloudConnectEngine

Hence the data collector failed with

2020-11-09 22:07:39,251 +0000 log_level=ERROR, pid=27340, tid=Thread-4, file=ta_data_collector.py, func_name=index_data, code_line_no=113 | [stanza_name="NR_Events"] Failed to index data

Does anybody experienced the same issue and know how to resolve it?

Thanks in advance.

Re: Splunk_TA_New_Relic Insight not ingesting data

fulldanad — Thu, 03 Dec 2020 21:27:04 GMT

Hi,

I have the same issue : I've created an add-on with Splunk Add-on builder and it was working fine until I upgraded Splunk to version 8.0.6.

Now I get the following message evertime I run a test :

Traceback (most recent call last):
File "/data/splunk/etc/apps/TA-nexthink/bin/nxengine_dgsi11test_1607030152_560.py", line 14, in <module>
import input_module_nxengine_dgsi11test_1607030152_560 as input_module
File "/splunk/etc/apps/TA-nexthink/bin/input_module_nx11test_1607030152_560.py", line 29, in <module>
from cloudconnectlib.client import CloudConnectClient
File "/splunk/etc/apps/TA-nexthink/bin/ta_nexthink/aob_py3/cloudconnectlib/client.py", line 8, in <module>
from .configuration import get_loader_by_version
File "/splunk/etc/apps/TA-nexthink/bin/ta_nexthink/aob_py3/cloudconnectlib/configuration/__init__.py", line 1, in <module>
from .loader import get_loader_by_version
File "/splunk/etc/apps/TA-nexthink/bin/ta_nexthink/aob_py3/cloudconnectlib/configuration/loader.py", line 15, in <module>
from ..core.exceptions import ConfigException
File "/splunk/etc/apps/TA-nexthink/bin/ta_nexthink/aob_py3/cloudconnectlib/core/__init__.py", line 1, in <module>
from .engine import CloudConnectEngine
File "/splunk/etc/apps/TA-nexthink/bin/ta_nexthink/aob_py3/cloudconnectlib/core/engine.py", line 6, in <module>
from .http import HttpClient
File "/splunk/etc/apps/TA-nexthink/bin/ta_nexthink/aob_py3/cloudconnectlib/core/http.py", line 26, in <module>
'http_no_tunnel': socks.PROXY_TYPE_HTTP_NO_TUNNEL,
AttributeError: module 'socks' has no attribute 'PROXY_TYPE_HTTP_NO_TUNNEL'

Context :

Proxy : none

Url : https

Authentication : basic

I guess it is linked to the upgrade, but the we should not be the only ones to experience this. Anyone else as this ?

Re: Splunk_TA_New_Relic Insight not ingesting data

davidbann — Tue, 30 Mar 2021 17:54:51 GMT

Just hit this myself. Were you able to resolve it?

Re: Splunk_TA_New_Relic Insight not ingesting data

a_hadiwidjaja — Wed, 31 Mar 2021 02:01:42 GMT

Unfortunately not. This error happened when I tried to ingest events from New Relic. I then resorted to the New Relic NRQL Command for Splunk" add-on to get the data from New relic events.

https://splunkbase.splunk.com/app/4988/

Re: Splunk_TA_New_Relic Insight not ingesting data

wmiscio — Thu, 29 Apr 2021 10:49:50 GMT

Hi @fulldanad , I'm having the same problem as you.

My version:

Splunk Enterprise
Version: 8.1.3.

Were you able to correct this problem?

Re: Splunk_TA_New_Relic Insight not ingesting data

kalyaniadm_wipr — Thu, 13 May 2021 16:51:59 GMT

Hi ,

I am facing this problem after upgarde to 8.1.2 with all the custom add-ons.

Anyone who is able to resolve it.

TIA

Re: Splunk_TA_New_Relic Insight not ingesting data

namesjc — Fri, 14 May 2021 08:56:57 GMT

I'm facing the same issue, from the error message:

AttributeError: module 'socks' has no attribute 'PROXY_TYPE_HTTP_NO_TUNNEL'

I found that there are two socks.py file in new relic app folder

one is in: /opt/splunk/etc/apps/Splunk_TA_New_Relic/bin/splunk_ta_new_relic

the other one is in: /opt/splunk/etc/apps/Splunk_TA_New_Relic/bin/splunk_ta_new_relic/aob_py3/httplib2

the error message indicates that the issue is regarding file /opt/splunk/etc/apps/Splunk_TA_New_Relic/bin/splunk_ta_new_relic/aob_py3/cloudconnectlib/core/http.py, the socks module is imported by "from httplib2 import socks", it should use the sock.py file in the folder /opt/splunk/etc/apps/Splunk_TA_New_Relic/bin/splunk_ta_new_relic/aob_py3/httplib2, but it's not, after checking the sock.py file in /opt/splunk/etc/apps/Splunk_TA_New_Relic/bin/splunk_ta_new_relic, it doesn't have attribute "PROXY_TYPE_HTTP_NO_TUNNEL"(around line 77), somehow the http.py invoke the wrong socks.py file.

So I just try to rename the sock.py file to other name in folder /opt/splunk/etc/apps/Splunk_TA_New_Relic/bin/splunk_ta_new_relic, issue solved.

This is a workaroud , I don't know what's the effect to rename the sock.py file.

Re: Splunk_TA_New_Relic Insight not ingesting data

samejgink — Thu, 01 Jul 2021 19:36:19 GMT

This is directly tied to versions of Splunk.. I just came across this today, I have recently updated a heavy forwarder from 8.0.7 to 8.2.0, my previously built apps are still working without issue. I went to create a new barebones REST API app and ran into that exact error message. I compared the folder structure of the python libraries that are tacked on when creating a new app with Add-on Builder and they were entirely different. I ended up making a copy of...

/opt/splunk/etc/apps/<MY APP>/bin/ta_illinois_university_housing_api/aob_py3/httplib2/socks.py

...And placing it one directory level up. This resolved the problem, and also mimics the folder structure of my older apps.
Has anyone (else!) submitted a ticket to Splunk regarding this? Thats a major bug.

Re: Splunk_TA_New_Relic Insight not ingesting data

josh12121984 — Mon, 19 Jul 2021 11:58:28 GMT

I am having the same problem. seems like Splunk is releasing these addons without proper testing

Re: Splunk_TA_New_Relic Insight not ingesting data

josh12121984 — Mon, 19 Jul 2021 12:42:50 GMT

Thanks. below work around is resolved the problem. However, it's a Major bug and Splunk must resolve it in next release.

Re: Splunk_TA_New_Relic Insight not ingesting data

a_hadiwidjaja — Thu, 09 Sep 2021 00:34:56 GMT

I tried what samejgink suggested above and it worked.

Re: Splunk_TA_New_Relic Insight not ingesting data

adri2915 — Tue, 07 Dec 2021 19:56:50 GMT

Hi, Can you show the path where you puts the copy for this path?

/opt/splunk/etc/apps/<MY APP>/bin/ta_illinois_university_housing_api/aob_py3/httplib2/socks.py

Re: Splunk_TA_New_Relic Insight not ingesting data

josh12121984 — Wed, 08 Dec 2021 10:32:30 GMT

I was able to resolve the http tunnel related issue. however i observed a new issue that http calls with requests package is not working and getting 403 forbidden error. the same script was working fine on previous versions. I had rewrite my script using http.client method.