topic Re: Splunk Python SDK failing with BadStatusLine error in Splunk Dev

Splunk Python SDK failing with BadStatusLine error

bruceclarke — Wed, 09 Mar 2016 20:11:15 GMT

Hi all,

I'm having an issue with the Python SDK. I'm running the latest version of the SDK (1.5.0) on python 2.7.10. Whever I try to connect to my instance I get the following error:

Traceback (most recent call last):
  File "event_types.py", line 44, in <module>
    main()
  File "event_types.py", line 32, in main
    service = connect(**opts.kwargs)
  File "..\splunklib\client.py", line 321, in connect
    s.login()
  File "..\splunklib\binding.py", line 847, in login
    cookie="1") # In Splunk 6.2+, passing "cookie=1" will return the "set-cookie" header
  File "..\splunklib\binding.py", line 1185, in post
    return self.request(url, message)
  File "..\splunklib\binding.py", line 1202, in request
    response = self.handler(url, message, **kwargs)
  File "..\splunklib\binding.py", line 1339, in request
    response = connection.getresponse()
  File "C:\Python27\lib\httplib.py", line 1067, in getresponse
    response.begin()
  File "C:\Python27\lib\httplib.py", line 409, in begin
    version, status, reason = self._read_status()
  File "C:\Python27\lib\httplib.py", line 373, in _read_status
    raise BadStatusLine(line)
httplib.BadStatusLine: ''

I recently upgraded my Python version. Is there any reason that 2.7.10 wouldn't work with the current version of the SDK? Is there a workaround for this error?

Thanks!

Re: Splunk Python SDK failing with BadStatusLine error

jkat54 — Wed, 09 Mar 2016 22:31:19 GMT

I'm not 100% sure but I do use Python 2.7.10 myself without issue. So I don't think the upgrade is the problem. It could be related because they handle your object a bit differently etc. It's just unlikely.

If we focus on the error message, it's says it's getting a bad status message from the httplib request. Its expecting a code like 2xx,3xx,4xx,5xx (404 page not found for example), but instead it's getting something unexpected and falling into an exception case.

I think if you try to use curl from the same affected machine to the same server, you might get more details. Maybe you'll get a very strange error message related to tcp stack corruption, no route to host, etc. Can you try curling the server fr the machine and post the response you get?

Re: Splunk Python SDK failing with BadStatusLine error

bruceclarke — Wed, 09 Mar 2016 22:42:55 GMT

Ah, so I'm not getting any response when trying to use an http scheme. When I switch to https, the curl works fine, but the SDK still exits with an error. The error is different though:

Traceback (most recent call last):
  File "event_types.py", line 44, in <module>
    main()
  File "event_types.py", line 32, in main
    service = connect(**opts.kwargs)
  File "..\splunklib\client.py", line 321, in connect
    s.login()
  File "..\splunklib\binding.py", line 847, in login
    cookie="1") # In Splunk 6.2+, passing "cookie=1" will return the "set-cookie" header
  File "..\splunklib\binding.py", line 1185, in post
    return self.request(url, message)
  File "..\splunklib\binding.py", line 1202, in request
    response = self.handler(url, message, **kwargs)
  File "..\splunklib\binding.py", line 1334, in request
    connection = connect(scheme, host, port)
  File "..\splunklib\binding.py", line 1317, in connect
    kwargs['context'] = ssl._create_unverified_context()
AttributeError: 'module' object has no attribute '_create_unverified_context'

Do I need to update a separate package for compatibility with the Splunk SDK?

Re: Splunk Python SDK failing with BadStatusLine error

jkat54 — Thu, 10 Mar 2016 00:04:02 GMT

Can you show me the code you're using complete with the server address etc. ?

Please mask the domain or IP address but I'm interested in the port numbers, and the syntax and the actual code.

Re: Splunk Python SDK failing with BadStatusLine error

bruceclarke — Thu, 10 Mar 2016 00:23:16 GMT

I'm just running the event_types.py file (under the examples folder with the Splunk SDK release) with my environment variables specified.

import sys, os
sys.path.insert(0, os.path.join(os.path.dirname(__file__), ".."))

from splunklib.client import connect

try:
    from utils import parse
except ImportError:
    raise Exception("Add the SDK repository to your PYTHONPATH to run the examples "
                    "(e.g., export PYTHONPATH=~/splunk-sdk-python.")

def main():
    opts = parse(sys.argv[1:], {}, ".splunkrc")
    service = connect(**opts.kwargs)

    for item in service.event_types:
        print "%s" % item.name
        print '='*len(item.name)
        content = item.content
        for key in sorted(content.keys()):
            value = content[key]
            print "%s: %s" % (key, value)
        print

if __name__ == "__main__":
    main()

Here is what is in my .splunkrc file:
host=mySplunk
port=8089
username=admin
password=myPassword
scheme=https
version=6.3

Re: Splunk Python SDK failing with BadStatusLine error

jkat54 — Thu, 10 Mar 2016 01:23:32 GMT

Ah, it's failing based on your opts.kwargs (which is read from you .splunkrc file).

File "event_types.py", line 32, in main
service = connect(**opts.kwargs)

Sorry but I was on a mobile phone earlier. Something in your keyword arguments maybe isnt "cool".

Do you have a strong password with special characters etc? If so, try surrounding the values with single or double quotes like this:

host='myhost'
port='8089'
username='admin'
password='my$pec!@lP@ssw0rd!'
scheme=https #<-unfortunately I dont know if this is correct, maybe needs to be ssl, im looking at httplib2 now (what splunk uses in the connect() function)
version=6.3 #<-unfortunately I dont know if its needed, maybe try commenting it out and testing

Re: Splunk Python SDK failing with BadStatusLine error

bruceclarke — Thu, 10 Mar 2016 01:33:03 GMT

No difference, unfortunately. I still get the same error on the same line.

Re: Splunk Python SDK failing with BadStatusLine error

jkat54 — Thu, 10 Mar 2016 01:33:34 GMT

Hey, are you using splunk free for this? If so, i think that is the problem. Looks like this can be related to unsupported ssl ciphers that are used in the trial version. You can download a splunk enterprise trial and test with it instead if so.

Re: Splunk Python SDK failing with BadStatusLine error

bruceclarke — Thu, 10 Mar 2016 01:46:39 GMT

I'm using a full enterprise instance.

Re: Splunk Python SDK failing with BadStatusLine error

bruceclarke — Thu, 10 Mar 2016 04:41:30 GMT

@jkat54 Thanks for all the help here. I upgraded to Python 2.7.11 and it seems to have fixed the issue. Still unclear what might have been fixed in the upgrade, but I assume it's something in the ssl module.

Re: Splunk Python SDK failing with BadStatusLine error

bruceclarke — Thu, 10 Mar 2016 04:42:13 GMT

It turns out that updating to Python 2.7.11 fixed the issue. I'm not sure what bug fix might have been addressed in the minor upgrade, but at least we're in a working state now.

Re: Splunk Python SDK failing with BadStatusLine error

jkat54 — Thu, 10 Mar 2016 05:09:26 GMT

Didnt see that one coming... good work on the solution! Thanks for working with me!