All Apps and Add-ons

Arista Networks Telemetry For Splunk: Why are events from Arista network device containing "ERROR: unable to connect to eAPI"?

ben_leung
Builder

Events coming from the Arista network device all contain the content "ERROR: unable to connect to eAPI".
I notice that the source and source types are scattered, so it seems the data is not generated correctly at the device before sending to Splunk.

Splunk internal logs from the device output :

ERROR ExecProcessor - message from "/usr/bin/eosfacts -r splunk.inventory -c /persist/sys/splunkforwarder/etc/arista.conf -index arista-splunk" No handlers could be found for logger "pyeapi.eapilib"

Working with someone that manages the Arista device, as I am unable to access the device itself to see what is configured.
They are suggesting that the credentials are setup wrong. I am not sure what user and password need to be input on the forwarder instance.
Any help would be appreciated!

0 Karma

fredhsu
Engager

For the Splunk extension you will need to enable eAPI on the switch and provide a user with access to eAPI. You can enable eAPI by the following configuration on the switch:

management api http-commands
  no shutdown

To configure a user you can use:

username <user> secret <pass>

Then specify this user and password in the splunk-forwarder configuration:

splunk-forwarder
    http-commands username <name>
    http-commands secret <passphrase>

Alternatively you can use UNIX sockets which eliminates the need for a user configured by specifying the following in the splunk-forwarder configuration:

splunk-forwarder
    http-commands protocol socket

ben_leung
Builder

Another follow question would be, does the credentials for the eAPI have to be the same on the instances of splunk that receive data from the switch (not just forwarder)?

0 Karma

sakti
Engager

The credentials set for eapi and forwarder has to be the same. Indexer credentials need not be the same as the one set on switch.

0 Karma
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...