All Apps and Add-ons

Arista Networks Telemetry For Splunk: Why are events from Arista network device containing "ERROR: unable to connect to eAPI"?


Events coming from the Arista network device all contain the content "ERROR: unable to connect to eAPI".
I notice that the source and source types are scattered, so it seems the data is not generated correctly at the device before sending to Splunk.

Splunk internal logs from the device output :

ERROR ExecProcessor - message from "/usr/bin/eosfacts -r splunk.inventory -c /persist/sys/splunkforwarder/etc/arista.conf -index arista-splunk" No handlers could be found for logger "pyeapi.eapilib"

Working with someone that manages the Arista device, as I am unable to access the device itself to see what is configured.
They are suggesting that the credentials are setup wrong. I am not sure what user and password need to be input on the forwarder instance.
Any help would be appreciated!

0 Karma


For the Splunk extension you will need to enable eAPI on the switch and provide a user with access to eAPI. You can enable eAPI by the following configuration on the switch:

management api http-commands
  no shutdown

To configure a user you can use:

username <user> secret <pass>

Then specify this user and password in the splunk-forwarder configuration:

    http-commands username <name>
    http-commands secret <passphrase>

Alternatively you can use UNIX sockets which eliminates the need for a user configured by specifying the following in the splunk-forwarder configuration:

    http-commands protocol socket


Another follow question would be, does the credentials for the eAPI have to be the same on the instances of splunk that receive data from the switch (not just forwarder)?

0 Karma


The credentials set for eapi and forwarder has to be the same. Indexer credentials need not be the same as the one set on switch.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Customer Survey!

If you use Splunk Observability Cloud, we invite you to share your valuable insights with us through a brief ...

Happy CX Day, Splunk Community!

Happy CX Day, Splunk Community! CX stands for Customer Experience, and today, October 3rd, is CX Day — a ...

.conf23 | Get Your Cybersecurity Defense Analyst Certification in Vegas

We’re excited to announce a new Splunk certification exam being released at .conf23! If you’re going to Las ...