topic Re: splunk forwarder not send data to python socket.io in Getting Data In

splunk forwarder not send data to python socket.io

hammad_yasir — Fri, 08 Oct 2021 07:51:56 GMT

Hi i hope everyone will be fine.i am facing issue .I am forwarding logs to third party like port of any system.i seen error message at port i am using python third party library scoket.io i face error "code 400, message Bad request version ('nCurrent=0')".help me to solve my issue.with python standard libraray name socket work fine with splunk.when i use with scoket.io libraray its crate error bad request.

Re: splunk forwarder not send data to python socket.io

PickleRick — Fri, 08 Oct 2021 13:45:44 GMT

What exactly are you trying to do?

How do you have it configured?

Re: splunk forwarder not send data to python socket.io

hammad_yasir — Fri, 08 Oct 2021 14:03:27 GMT

/opt/splunkforwarder/etc/system/local

[tcpout]
defaultGroup = default-autolb-group

[tcpout:default-autolb-group]
server = 192.168.20.185:4845
sendCookedData = false
[tcpout-server://192.168.20.185:4845]

Re: splunk forwarder not send data to python socket.io

hammad_yasir — Fri, 08 Oct 2021 14:05:00 GMT

at python side i have write code

import eventlet import socketio sio = socketio.Server() app = socketio.WSGIApp(sio, static_files={ '/': {'content_type': 'text/html', 'filename': 'index.html'} }) @sio.event def connect(sid, environ): print('connect ', sid) @sio.event def my_message(sid, data): print('message ', data) @sio.event def disconnect(sid): print('disconnect ', sid) if __name__ == '__main__': eventlet.wsgi.server(eventlet.listen(('192.168.20.185', 4848)), app)

Re: splunk forwarder not send data to python socket.io

PickleRick — Fri, 08 Oct 2021 18:15:46 GMT

Now it's more like it. So you're trying to send events via tcpout output which uses proprietary s2s protocol to your wsgi app which expects http.

With sufficiently new forwarder you could try to set up http forwarding.

https://docs.splunk.com/Documentation/Forwarder/8.2.2/Forwarder/Configureforwardingwithoutputs.conf#Configure_the_universal_forwarder_to_send_data_over_HTTP