All Apps and Add-ons

Arista Networks Telemetry For Splunk: Why are events from Arista network device containing "ERROR: unable to connect to eAPI"?

ben_leung
Builder

Events coming from the Arista network device all contain the content "ERROR: unable to connect to eAPI".
I notice that the source and source types are scattered, so it seems the data is not generated correctly at the device before sending to Splunk.

Splunk internal logs from the device output :

ERROR ExecProcessor - message from "/usr/bin/eosfacts -r splunk.inventory -c /persist/sys/splunkforwarder/etc/arista.conf -index arista-splunk" No handlers could be found for logger "pyeapi.eapilib"

Working with someone that manages the Arista device, as I am unable to access the device itself to see what is configured.
They are suggesting that the credentials are setup wrong. I am not sure what user and password need to be input on the forwarder instance.
Any help would be appreciated!

0 Karma

fredhsu
Engager

For the Splunk extension you will need to enable eAPI on the switch and provide a user with access to eAPI. You can enable eAPI by the following configuration on the switch:

management api http-commands
  no shutdown

To configure a user you can use:

username <user> secret <pass>

Then specify this user and password in the splunk-forwarder configuration:

splunk-forwarder
    http-commands username <name>
    http-commands secret <passphrase>

Alternatively you can use UNIX sockets which eliminates the need for a user configured by specifying the following in the splunk-forwarder configuration:

splunk-forwarder
    http-commands protocol socket

ben_leung
Builder

Another follow question would be, does the credentials for the eAPI have to be the same on the instances of splunk that receive data from the switch (not just forwarder)?

0 Karma

sakti
Engager

The credentials set for eapi and forwarder has to be the same. Indexer credentials need not be the same as the one set on switch.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...