topic Re: Adding proxy support for Splunk Add-on for Salesforce Streaming API (TA-sfdc-streaming-api) in All Apps and Add-ons

Adding proxy support for Splunk Add-on for Salesforce Streaming API (TA-sfdc-streaming-api)

yeahnah — Wed, 12 Apr 2023 23:30:07 GMT

Hi Splunk Works

We're investigating using the Splunk Add-on for Salesforce Streaming API (TA-sfdc-streaming-api) app (v1.0.5 - https://splunkbase.splunk.com/app/5689) .

I see it does not currently have proxy configuration support in the app. The business does not want to configure the whole Splunk instance to be proxy enabled and would like to limit it to app configuration.

Are there any plans to add this support in the near future?

Thanks

Re: Adding proxy support for Splunk Add-on for Salesforce Streaming API (TA-sfdc-streaming-api)

mik3y — Tue, 19 Mar 2024 05:52:56 GMT

@yeahnah

One of our salesforce security guys found a workaround that involves modifying a few python scripts under the lib folder.

There are two methods, long polling and web sockets. Long polling was applicable to us so we just fixed that.

Some information on the usage of proxy settings in aiohttp can be found here:

Advanced Client Usage — aiohttp 3.9.3 documentation

The fixes can be applied to the TA-sfdc-streaming-api pack and below is what we modified to successfully subscribe via a proxy.

1. Modify /opt/splunk/etc/apps/TA-sfdc-streaming-api/lib/aiocometd/transports/long_polling.py

search for one instance of "session.post" and add ,proxy="http://<proxyip>:<port>"

2. Modify /opt/splunk/etc/apps/TA-sfdc-streaming-api/lib/aiosfstream/auth.py

search for two instances of "session.post" and add ,proxy="http://<proxyip>:<port>"

Hope this helps!

Re: Adding proxy support for Splunk Add-on for Salesforce Streaming API (TA-sfdc-streaming-api)

yeahnah — Tue, 19 Mar 2024 20:00:53 GMT

Hi @mik3y

Thanks for the update and the workaround solution.

In the end we moved away from this solution anyway as the Salesforce streaming API did not provide ability to track the events that had already been ingested, potentially resulting in missed data during Splunk maintenance.