Error pulling data from Cortex via API

dfourie — Fri, 16 Aug 2024 09:36:28 GMT

I am trying to ingest data from Cortex via API, the API works 100% but getting the following script errors in splunkd.log

Also attached the log from my partners environment where we need to complete the integration.

8-14-2024 10:30:27.459 +0200 ERROR ScriptRunner [12760 TcpChannelThread] - stderr from 'C:\Program Files\Splunk\bin\Python3.exe C:\Program Files\Splunk\bin\runScript.py execute':    return func(*args, **kwargs)
08-14-2024 10:30:28.269 +0200 ERROR PersistentScript [20724 PersistentScriptIo] - From {"C:\Program Files\Splunk\bin\Python3.exe" "C:\Program Files\Splunk\etc\apps\Splunk_TA_paloalto\bin\Splunk_TA_paloalto_rh_settings.py" persistent}: WARNING:root:Run function: get_password failed: Traceback (most recent call last):
08-14-2024 10:30:28.269 +0200 ERROR PersistentScript [20724 PersistentScriptIo] - From {"C:\Program Files\Splunk\bin\Python3.exe" "C:\Program Files\Splunk\etc\apps\Splunk_TA_paloalto\bin\Splunk_TA_paloalto_rh_settings.py" persistent}:   File "C:\Program Files\Splunk\etc\apps\Splunk_TA_paloalto\bin\splunk_ta_paloalto\aob_py3\solnlib\utils.py", line 153, in wrapper
08-14-2024 10:30:28.269 +0200 ERROR PersistentScript [20724 PersistentScriptIo] - From {"C:\Program Files\Splunk\bin\Python3.exe" "C:\Program Files\Splunk\etc\apps\Splunk_TA_paloalto\bin\Splunk_TA_paloalto_rh_settings.py" persistent}:     return func(*args, **kwargs)
08-14-2024 10:30:28.269 +0200 ERROR PersistentScript [20724 PersistentScriptIo] - From {"C:\Program Files\Splunk\bin\Python3.exe" "C:\Program Files\Splunk\etc\apps\Splunk_TA_paloalto\bin\Splunk_TA_paloalto_rh_settings.py" persistent}:   File "C:\Program Files\Splunk\etc\apps\Splunk_TA_paloalto\bin\splunk_ta_paloalto\aob_py3\solnlib\credentials.py", line 137, in get_password
08-14-2024 10:30:28.269 +0200 ERROR PersistentScript [20724 PersistentScriptIo] - From {"C:\Program Files\Splunk\bin\Python3.exe" "C:\Program Files\Splunk\etc\apps\Splunk_TA_paloalto\bin\Splunk_TA_paloalto_rh_settings.py" persistent}:     f"Failed to get password of realm={self._realm}, user={user}."
08-14-2024 10:30:28.269 +0200 ERROR PersistentScript [20724 PersistentScriptIo] - From {"C:\Program Files\Splunk\bin\Python3.exe" "C:\Program Files\Splunk\etc\apps\Splunk_TA_paloalto\bin\Splunk_TA_paloalto_rh_settings.py" persistent}: solnlib.credentials.CredentialNotExistException: Failed to get password of realm=__REST_CREDENTIAL__#Splunk_TA_paloalto#configs/conf-splunk_ta_paloalto_settings, user=proxy.
08-14-2024 10:30:28.269 +0200 ERROR PersistentScript [20724 PersistentScriptIo] - From {"C:\Program Files\Splunk\bin\Python3.exe" "C:\Program Files\Splunk\etc\apps\Splunk_TA_paloalto\bin\Splunk_TA_paloalto_rh_settings.py" persistent}: .
08-14-2024 10:30:28.361 +0200 ERROR PersistentScript [20724 PersistentScriptIo] - From {"C:\Program Files\Splunk\bin\Python3.exe" "C:\Program Files\Splunk\etc\apps\Splunk_TA_paloalto\bin\Splunk_TA_paloalto_rh_settings.py" persistent}: WARNING:root:Run function: get_password failed: Traceback (most recent call last):
08-14-2024 10:30:28.361 +0200 ERROR PersistentScript [20724 PersistentScriptIo] - From {"C:\Program Files\Splunk\bin\Python3.exe" "C:\Program Files\Splunk\etc\apps\Splunk_TA_paloalto\bin\Splunk_TA_paloalto_rh_settings.py" persistent}:   File "C:\Program Files\Splunk\etc\apps\Splunk_TA_paloalto\bin\splunk_ta_paloalto\aob_py3\solnlib\utils.py", line 153, in wrapper
08-14-2024 10:30:28.361 +0200 ERROR PersistentScript [20724 PersistentScriptIo] - From {"C:\Program Files\Splunk\bin\Python3.exe" "C:\Program Files\Splunk\etc\apps\Splunk_TA_paloalto\bin\Splunk_TA_paloalto_rh_settings.py" persistent}:     return func(*args, **kwargs)
08-14-2024 10:30:28.361 +0200 ERROR PersistentScript [20724 PersistentScriptIo] - From {"C:\Program Files\Splunk\bin\Python3.exe" "C:\Program Files\Splunk\etc\apps\Splunk_TA_paloalto\bin\Splunk_TA_paloalto_rh_settings.py" persistent}:   File "C:\Program Files\Splunk\etc\apps\Splunk_TA_paloalto\bin\splunk_ta_paloalto\aob_py3\solnlib\credentials.py", line 137, in get_password
08-14-2024 10:30:28.361 +0200 ERROR PersistentScript [20724 PersistentScriptIo] - From {"C:\Program Files\Splunk\bin\Python3.exe" "C:\Program Files\Splunk\etc\apps\Splunk_TA_paloalto\bin\Splunk_TA_paloalto_rh_settings.py" persistent}:     f"Failed to get password of realm={self._realm}, user={user}."
08-14-2024 10:30:28.361 +0200 ERROR PersistentScript [20724 PersistentScriptIo] - From {"C:\Program Files\Splunk\bin\Python3.exe" "C:\Program Files\Splunk\etc\apps\Splunk_TA_paloalto\bin\Splunk_TA_paloalto_rh_settings.py" persistent}: solnlib.credentials.CredentialNotExistException: Failed to get password of realm=__REST_CREDENTIAL__#Splunk_TA_paloalto#configs/conf-splunk_ta_paloalto_settings, user=additional_parameters.

Please advise.

Re: Error pulling data from Cortex via API

marnall — Sun, 18 Aug 2024 08:52:13 GMT

As a test, could you add dummy credentials to the proxy and "additional_parameters" field?

topic Re: Error pulling data from Cortex via API in Getting Data In

Error pulling data from Cortex via API

Re: Error pulling data from Cortex via API