topic Re: data not going to splunk in Splunk Dev

data not going to splunk

tiongjss1 — Wed, 06 Feb 2013 06:46:12 GMT

Hi, I am relatively new on this, and I am having a problem right now.

When I run the twitted system from the python sdk, there seems to be no data being pushed into splunk.

It seems that the input.py is always stuck on the "initializing splunk" area.

My TCP port for both splunkrc and input.py are both 9002. Am I doing something wrong? Please tell me. Thank you.

Re: data not going to splunk

Neeraj_Luthra — Wed, 06 Feb 2013 07:16:19 GMT

The twitted example reads .splunkrc to build a URL to Splunk's management port to write data into Splunk. I am assuming you are running Splunk on the default ports, i.e. 8000 for web and 8089 for management. If so, to run this example, your .splunkrc should have the management port listed, i.e. 8089.

Re: data not going to splunk

tiongjss1 — Wed, 06 Feb 2013 07:25:05 GMT

Thank you for your quick reply. I tried what you suggested, however, I have the error "HTTP 400 Bad Request--In handler 'raw' : Parameter name:TCP Port 8089 not available"

Another question: are we able to list more than one port in the system?

Re: data not going to splunk

Neeraj_Luthra — Wed, 06 Feb 2013 07:36:13 GMT

Yes, you should be able to. Make sure that Splunk is indeed running on that port and you can hit https://localhost:8089 from the browser or command line (using curl)? Also, can you post the entire error you are getting?

Re: data not going to splunk

Neeraj_Luthra — Wed, 06 Feb 2013 18:15:07 GMT

If you can undo all your changes to the input.py and make sure your .splunkrc looks something like this:

scheme=https

host=localhost

port=8089

username=admin

password=changeme

Then from the root of the Python SDK, run this command with no extra arguments

python examples/twitted/input.py

If this doesn't work, provide the output from this command.

Re: data not going to splunk

tiongjss1 — Thu, 07 Feb 2013 02:21:01 GMT

Thank you for replying. The problem has now been oddly changed to "HTTP 400 Bad Request--In handler 'raw' : Parameter name:TCP Port 9001 not available". Is it the same thing or is it different?

Re: data not going to splunk

Neeraj_Luthra — Thu, 07 Feb 2013 02:58:30 GMT

Do you have anything running on your machine on port 9001? Email me so I can work with you offline and we can then post the resolution here.

Re: data not going to splunk

Neeraj_Luthra — Fri, 08 Feb 2013 20:42:45 GMT

This is resolved. A clean refresh of the SDK examples and .splunkrc solved the problem.