Hi Splunk Works
We're investigating using the Splunk Add-on for Salesforce Streaming API (TA-sfdc-streaming-api) app (v1.0.5 - https://splunkbase.splunk.com/app/5689) .
I see it does not currently have proxy configuration support in the app. The business does not want to configure the whole Splunk instance to be proxy enabled and would like to limit it to app configuration.
Are there any plans to add this support in the near future?
Thanks
One of our salesforce security guys found a workaround that involves modifying a few python scripts under the lib folder.
There are two methods, long polling and web sockets. Long polling was applicable to us so we just fixed that.
Some information on the usage of proxy settings in aiohttp can be found here:
Advanced Client Usage — aiohttp 3.9.3 documentation
The fixes can be applied to the TA-sfdc-streaming-api pack and below is what we modified to successfully subscribe via a proxy.
1. Modify /opt/splunk/etc/apps/TA-sfdc-streaming-api/lib/aiocometd/transports/long_polling.py
search for one instance of "session.post" and add ,proxy="http://<proxyip>:<port>"
2. Modify /opt/splunk/etc/apps/TA-sfdc-streaming-api/lib/aiosfstream/auth.py
search for two instances of "session.post" and add ,proxy="http://<proxyip>:<port>"
Hope this helps!
Hi @mik3y
Thanks for the update and the workaround solution.
In the end we moved away from this solution anyway as the Salesforce streaming API did not provide ability to track the events that had already been ingested, potentially resulting in missed data during Splunk maintenance.