When attempting to fill out the inputs for DUO logs in the UI, we get the following cryptic error...
Encountered the following error while trying to save: Splunkd daemon is not responding: ("Error connecting to /servicesNS/emcdaniel/duo_splunkapp/data/inputs/duo_input: ('The read operation timed out',)",)
We also saw the following in splunkd logs
07-20-2016 18:45:36.396 -0400 WARN ModularInputs - Validation for scheme=duo failed: The script returned with exit status 1.
Anyone have any idea what is happening here?
Just wanted to answer my own question here since we were able to figure out what was going on here.
If you figure this out, or you just give up and create your inputs.conf file manually, everything works fine because the validation workflow above only occurs when building out your modular inputs from the UI. The 3 second timeout only applies to validation of your inputs when building the input config. The timeout for the script when actually fetching the data (if one exists at all) is sufficiently long enough to fetch the data.
I'm having this same problem. I can see that ~/etc/apps/duosplunkapp/default/inputs.conf has fields for ikey, skey and apihost, but where does the name (requested in the Duo Splunk Input setup screen) go?
Did you ever figured that out?
No, I never did. A co-worker wrote a custom app and we chucked this one
Oh, man... I'm trying everything I can, but no success so far. Very frustrating.
Thanks for the quick response!