All Apps and Add-ons

ERROR Execution failed.

tah7004
Path Finder

Hello, I'm trying to configure ATOM input in my local Splunk instance as a test.
I'm seeing the following errors from the syndication_modular_input internal logs:

2019-07-24 09:16:37,033 ERROR Execution failed
Traceback (most recent call last):
File "/Applications/Splunk/etc/apps/syndication/bin/syndication_app/modular_input.py", line 1306, in execute
self.do_run(in_stream, log_exception_and_continue=True)
File "/Applications/Splunk/etc/apps/syndication/bin/syndication_app/modular_input.py", line 1206, in do_run
input_config)
File "/Applications/Splunk/etc/apps/syndication/bin/syndication.py", line 325, in run
results, last_entry_date_retrieved = self.get_feed(feed_url.geturl(), return_latest_date=True, include_later_than=last_entry_date, logger=self.logger, username=username, password=password, clean_html=clean_html)
File "/Applications/Splunk/etc/apps/syndication/bin/syndication.py", line 142, in get_feed
auth_handler = cls.get_auth_handler(feed_url, username, password)
File "/Applications/Splunk/etc/apps/syndication/bin/syndication.py", line 105, in get_auth_handler
realm, auth_type = cls.get_realm_and_auth_type(feed_url, username, password)
File "/Applications/Splunk/etc/apps/syndication/bin/syndication.py", line 89, in get_realm_and_auth_type
auth_type = match.groups()[0]
AttributeError: 'NoneType' object has no attribute 'groups'

0 Karma

tah7004
Path Finder

Is there a good way to trace the http request on the app? I tried using Chrome's developer mode, but I'm not even sure if the http authentication requests from the syndication app shows up there.

0 Karma

LukeMurphey
Champion

The authentication requests from the syndication app would not show up there but it would show the authentication attempt if you login from Chrome. You would need to:

1) Open the Developer console in Chrome
2) Open the feed URL and authenticate
3) View the network request in the "Network" tab of the console and look for the request with the "Authentication" header

Alternatively, you could save the session and I could look at it. The only problem with this is that the authentication would be included in the session.

0 Karma

tah7004
Path Finder

I don't really see any authentication headers in chrome.
I tried fiddler and that provides more of the authentication header info. How can I send the fiddler trace?

0 Karma

LukeMurphey
Champion

Yeah, you can send me the trace (Luke at LukeMurphey.net). I'll take a look and see if I can figure this out.

0 Karma

tah7004
Path Finder

Hello, can you let me know if you received the fiddler trace?

0 Karma

LukeMurphey
Champion

Sorry for failing to respond. I did. I was having some problems getting fiddler installed. I'm going to try on a different machine. I'll get back to you soon.

0 Karma

tah7004
Path Finder

Thanks, I just sent you an email withe the fiddler trace.

0 Karma

tah7004
Path Finder

This atom feed is from Bitlocker Administration Management.

0 Karma

tah7004
Path Finder

Is there a way to trace the http authentication requests for the app? I tried chrome's developer mode, but I'm not sure if those events are showing up there.

0 Karma

LukeMurphey
Champion

It looks like the app isn't able to parse the authentication request.

Could you confirm that this feed requires authentication?

0 Karma

tah7004
Path Finder

Yes, it requires basic authentication. I tested the credentials via browser and confirmed it works. I'm not sure why I see that group missing error at the end.

0 Karma

LukeMurphey
Champion

I cannot figure out why it would fail on this. I modified the code so that it no longer generates an error. However, it would still not work since it would now ignore the authentication request.

This is really hard for me to debug without seeing the HTTP request (specifically, header requesting authentication).

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...