Getting a 403 error trying to install the Splunk Add-on for AWS in Splunk on a cloud server with an assigned name. How to troubleshoot this?

[sashikalavenkat]

Splunk has been installed in a cloud server. Network team has assigned a name to the server, hence referral to the server works only with the assigned name and does not work when referred to as 'localhost' or '127.0.0.1'.

Tried installing the Splunk Add-on for Amazon Web Services, but there is a 403 error in the REST API call:

tid=MainThread file=rest.py:do_splunkd_request:91 | Failed to send rest request=https://127.0.0.1:8089/services/server/info, errcode=unknown, reason=Traceback (most recent call last):

Any idea on how to change the splunkd_uri value? Assigning value to splunkd_uri in the rest.py, configure.py with the TA_AWS package is not working.

[rkantamaneni_sp]

@sashikalavenkatesh Did you ever get this resolved?

[ehaddad_splunk]

Setting server name should not cause 127.0.0.1 to be inaccessible. it should always be accessible otherwise this could indicate network configuration issue. also, 403 is indicative of authentication failure and not access issue.
What happens if you ping 127.0.0.1 from the server itself. do you get any reply?

[sashikalavenkat]

Now this error seems to have got resolved, but still the connection configuration did not get through. Below is the error

06-09-2016 09:33:20.807 +0100 ERROR AdminManagerExternal - External handler failed with code '1' and output: 'Splunk Add-on REST Handler ERROR[400]: Bad Request - Splunkd daemon is not responding: ('Error connecting to /servicesNS/-/Splunk_TA_aws/storage/passwords/_aws_proxy%3Adefault%3A: [Errno 111] Connection refused',)'.  See splunkd.log for stderr output.

06-09-2016 09:33:20.800 +0100 ERROR ScriptRunner - stderr from '/opt/splunk/bin/python /opt/splunk/bin/runScript.py execute':  BaseException: Splunk Add-on REST Handler ERROR[400]: Bad Request - Splunkd daemon is not responding: ('Error connecting to /servicesNS/-/Splunk_TA_aws/storage/passwords/_aws_proxy%3Adefault%3A: [Errno 111] Connection refused',)

[sashikalavenkat]

I am getting a response for the ping command. There is a proxy server which filters all traffic to this server, unsure why even internal calls are going through the proxy.

This is the error at the end of the stack of errors i have posted above:

 File "/opt/splunk/etc/apps/Splunk_TA_aws/bin/splunktalib/httplib2/__init__.py", line 1060, in connect
    raise socket.error, msg
error: [Errno 111] Connection refused

[firas_noun]

Now it's 2024, did you find a solution? I'm facing the same problem right now.