Hi. I'm trying to set up the Cisco ACI Add-on for Splunk Enterprise v4.0 on Splunk Enterprise 6.5.1, and am getting connection errors in splunkd.log similar to this:
03-02-2017 11:34:46.679 -0600 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/TA_cisco-ACI/bin/collect.py -health fvTenant fvAp fvEPg fvAEPg fvBD vzFilter vzEntry vzBrCP fvCtx l3extOut fabricHealthTotal fabricNode eqptcapacityPolEntry5min eqptFabP eqptLeafP eqptCh eqptLC eqptFt eqptPsu eqptSupC ethpmPhysIf" Could not relogin to APIC due to ConnectionError
When I run the collect.py script from the command line, I get this:
splunk@server:[~/etc/apps/TA_cisco-ACI/bin]> /opt/splunk/bin/splunk cmd python collect.py
ACI Error: Did not receive a session key from splunkd. Please enable passAuth in inputs.conf for this script
Not sure how to troubleshoot this.
The most likely cause of your issue is not trusting your APICs SSL/TLS cert. My bandaid/fix was to edit TA_cisco-ACI/bin/config.ini.
I changed:
ENABLE_SSL = True
to
ENABLE_SSL = False
This setting description is: "Indicates whether SSL certificates must be verified"
I'm having the same issue on Splunk 6.6.1 with addon 4.0.1
If you want to call the script locally, you'll have to do something like what's in here: https://answers.splunk.com/answers/24319/using-a-scripted-inputs-passauth-token-for-cli-access-from-...
As for the ConnectionError - I'm still troubleshooting that