topic I cannot reach Splunk Cloud API from a python app in Splunk Dev

I cannot reach Splunk Cloud API from a python app

jalbarracinklar — Tue, 06 Aug 2024 20:54:00 GMT

Hello!

How are you?
We are currently working on an integration with Splunk Cloud to be able to retrieve a set of data that we persist in an index and then we search to generate a table.
For this, we need to use the Splunk Cloud API from another of our developments.
We generate a new local user on the platform and assign it a new role with 'search' permission on the index we need to query.
Then, we perform this test call from our computer:
curl -v -u username:p455w0rd -k https://<organization>.splunkcloud.com:8089/services/search/jobs -d search='index="index_to_query" rule="inventory" | stats count by rawData.Association.asset | sort - count'
but the response we get is as follows:
* Trying <IP>:8089....
* connect to<IP> port 8089 failed: Operation timed out
* Failed to connect to<organization>.splunkcloud.com port 8089 after 75195 ms: Couldn't connect to server

We investigated in Splunk forums and found that it could be caused by a Splunk Cloud restriction, and that apparently we could solve it by adding the subnets from where we do the consumption in: https://<organization>.splunkcloud.com/en-GB/manager/system/manage_system_config/ip_allow_list

We tried that but we're getting the same error message 😞

Have you faced this in the past?

Thank you very much!
Regards,
Juanma

Re: I cannot reach Splunk Cloud API from a python app

richgalloway — Wed, 07 Aug 2024 00:51:40 GMT

Verify your network allows connections *out* to your Splunk Cloud stack's port 8089.

Re: I cannot reach Splunk Cloud API from a python app

gcusello — Wed, 07 Aug 2024 07:08:50 GMT

Hi @jalbarracinklar ,

one of my customers had the same issue, they opened a ticet to Splunk Support and quickly solved.

Ciao.

Giuseppe

Re: I cannot reach Splunk Cloud API from a python app

jalbarracinklar — Fri, 09 Aug 2024 19:30:42 GMT

Grazie Giuseppe!

We're gonna try that 🙂

Re: I cannot reach Splunk Cloud API from a python app

jalbarracinklar — Fri, 09 Aug 2024 19:31:36 GMT

This is going through Internet and from different places so we don't have a FW blocking our traffic at the moment 😞