All Apps and Add-ons

Getting a 403 error trying to install the Splunk Add-on for AWS in Splunk on a cloud server with an assigned name. How to troubleshoot this?

sashikalavenkat
New Member

Splunk has been installed in a cloud server. Network team has assigned a name to the server, hence referral to the server works only with the assigned name and does not work when referred to as 'localhost' or '127.0.0.1'.

Tried installing the Splunk Add-on for Amazon Web Services, but there is a 403 error in the REST API call:

tid=MainThread file=rest.py:do_splunkd_request:91 | Failed to send rest request=https://127.0.0.1:8089/services/server/info, errcode=unknown, reason=Traceback (most recent call last):

Any idea on how to change the splunkd_uri value? Assigning value to splunkd_uri in the rest.py, configure.py with the TA_AWS package is not working.

0 Karma

rkantamaneni_sp
Splunk Employee
Splunk Employee

@sashikalavenkatesh Did you ever get this resolved?

0 Karma

ehaddad_splunk
Splunk Employee
Splunk Employee

Setting server name should not cause 127.0.0.1 to be inaccessible. it should always be accessible otherwise this could indicate network configuration issue. also, 403 is indicative of authentication failure and not access issue.
What happens if you ping 127.0.0.1 from the server itself. do you get any reply?

0 Karma

sashikalavenkat
New Member

Now this error seems to have got resolved, but still the connection configuration did not get through. Below is the error

06-09-2016 09:33:20.807 +0100 ERROR AdminManagerExternal - External handler failed with code '1' and output: 'Splunk Add-on REST Handler ERROR[400]: Bad Request - Splunkd daemon is not responding: ('Error connecting to /servicesNS/-/Splunk_TA_aws/storage/passwords/_aws_proxy%3Adefault%3A: [Errno 111] Connection refused',)'.  See splunkd.log for stderr output.

06-09-2016 09:33:20.800 +0100 ERROR ScriptRunner - stderr from '/opt/splunk/bin/python /opt/splunk/bin/runScript.py execute':  BaseException: Splunk Add-on REST Handler ERROR[400]: Bad Request - Splunkd daemon is not responding: ('Error connecting to /servicesNS/-/Splunk_TA_aws/storage/passwords/_aws_proxy%3Adefault%3A: [Errno 111] Connection refused',)
0 Karma

sashikalavenkat
New Member

I am getting a response for the ping command. There is a proxy server which filters all traffic to this server, unsure why even internal calls are going through the proxy.

This is the error at the end of the stack of errors i have posted above:

 File "/opt/splunk/etc/apps/Splunk_TA_aws/bin/splunktalib/httplib2/__init__.py", line 1060, in connect
    raise socket.error, msg
error: [Errno 111] Connection refused
0 Karma

firas_noun
New Member

Now it's 2024, did you find a solution? I'm facing the same problem right now.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...