Adding proxy support for Splunk Add-on for Salesforce Streaming API (TA-sfdc-streaming-api)

[yeahnah]

Hi Splunk Works

We're investigating using the Splunk Add-on for Salesforce Streaming API (TA-sfdc-streaming-api) app (v1.0.5 - https://splunkbase.splunk.com/app/5689) .

I see it does not currently have proxy configuration support in the app.   The business does not want to configure the whole Splunk instance to be proxy enabled and would like to limit it to app configuration.

Are there any plans to add this support in the near future?

Thanks

[mik3y]

@yeahnah 

One of our salesforce security guys found a workaround that involves modifying a few python scripts under the lib folder.

There are two methods, long polling and web sockets. Long polling was applicable to us so we just fixed that.

Some information on the usage of proxy settings in aiohttp can be found here:

Advanced Client Usage — aiohttp 3.9.3 documentation

The fixes can be applied to the TA-sfdc-streaming-api pack and below is what we modified to successfully subscribe via a proxy.

1. Modify /opt/splunk/etc/apps/TA-sfdc-streaming-api/lib/aiocometd/transports/long_polling.py

search for one instance of "session.post" and add  ,proxy="http://<proxyip>:<port>"

2. Modify /opt/splunk/etc/apps/TA-sfdc-streaming-api/lib/aiosfstream/auth.py

search for two instances of "session.post" and add ,proxy="http://<proxyip>:<port>"

Hope this helps!

[yeahnah]

Hi @mik3y 

Thanks for the update and the workaround solution.

In the end we moved away from this solution anyway as the Salesforce streaming API did not provide ability to track the events that had already been ingested, potentially resulting in missed data during Splunk maintenance.