All Apps and Add-ons

Receiving errors with installation of v2 Dropbox Business App for Splunk

mattalshab
Engager

Hi,
Installed v2 of the Dropbox app on our server running Splunk 7.1.3. I get a bunch of python errors and no data gets added to the index. I can use cURL to pull the events from the CLI so communication/authentication isn't an issue. We are currently running Python 2.7.5 on this server. I'm wondering if the app supports Python 2.7.5 or if I need to upgrade to Python 3.7

Can anyone confirm which version(s) of Python the dropbox for business app supports??

01-27-2020 14:04:53.843 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/splunk-app-dropbox/bin/dropbox.py" ConnectionError: HTTPSConnectionPool(host='api.dropboxapi.com', port=443): Max retries exceeded with url: /2/team_log/get_events (Caused by ReadTimeoutError("HTTPSConnectionPool(host='api.dropboxapi.com', port=443): Read timed out. (read timeout=5.0)",))
01-27-2020 14:04:53.843 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/splunk-app-dropbox/bin/dropbox.py"     raise ConnectionError(e, request=request)
01-27-2020 14:04:53.843 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/splunk-app-dropbox/bin/dropbox.py"   File "/opt/splunk/etc/apps/splunk-app-dropbox/bin/splunk_app_dropbox/requests/adapters.py", line 487, in send
01-27-2020 14:04:53.843 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/splunk-app-dropbox/bin/dropbox.py"     r = adapter.send(request, **kwargs)
01-27-2020 14:04:53.843 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/splunk-app-dropbox/bin/dropbox.py"   File "/opt/splunk/etc/apps/splunk-app-dropbox/bin/splunk_app_dropbox/requests/sessions.py", line 609, in send
01-27-2020 14:04:53.843 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/splunk-app-dropbox/bin/dropbox.py"     resp = self.send(prep, **send_kwargs)
01-27-2020 14:04:53.843 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/splunk-app-dropbox/bin/dropbox.py"   File "/opt/splunk/etc/apps/splunk-app-dropbox/bin/splunk_app_dropbox/requests/sessions.py", line 488, in request
01-27-2020 14:04:53.843 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/splunk-app-dropbox/bin/dropbox.py"     return self.http_session.request(method, url, **requests_args)
01-27-2020 14:04:53.843 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/splunk-app-dropbox/bin/dropbox.py"   File "/opt/splunk/etc/apps/splunk-app-dropbox/bin/splunk_app_dropbox/splunk_aoblib/rest_helper.py", line 43, in send_http_request
01-27-2020 14:04:53.843 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/splunk-app-dropbox/bin/dropbox.py"     proxy_uri=self._get_proxy_uri() if use_proxy else None)
01-27-2020 14:04:53.843 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/splunk-app-dropbox/bin/dropbox.py"   File "/opt/splunk/etc/apps/splunk-app-dropbox/bin/splunk_app_dropbox/modinput_wrapper/base_modinput.py", line 476, in send_http_request
01-27-2020 14:04:53.843 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/splunk-app-dropbox/bin/dropbox.py"     use_proxy=False,
01-27-2020 14:04:53.843 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/splunk-app-dropbox/bin/dropbox.py"   File "/opt/splunk/etc/apps/splunk-app-dropbox/bin/input_module_dropbox.py", line 110, in send_http_request
01-27-2020 14:04:53.843 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/splunk-app-dropbox/bin/dropbox.py"     response = send_http_request(helper, cursor, access_token, start_time, category)
01-27-2020 14:04:53.843 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/splunk-app-dropbox/bin/dropbox.py"   File "/opt/splunk/etc/apps/splunk-app-dropbox/bin/input_module_dropbox.py", line 59, in collect_events
01-27-2020 14:04:53.843 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/splunk-app-dropbox/bin/dropbox.py"     input_module.collect_events(self, ew)
01-27-2020 14:04:53.842 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/splunk-app-dropbox/bin/dropbox.py"   File "/opt/splunk/etc/apps/splunk-app-dropbox/bin/dropbox.py", line 72, in collect_events
01-27-2020 14:04:53.842 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/splunk-app-dropbox/bin/dropbox.py"     self.collect_events(ew)
01-27-2020 14:04:53.842 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/splunk-app-dropbox/bin/dropbox.py"   File "/opt/splunk/etc/apps/splunk-app-dropbox/bin/splunk_app_dropbox/modinput_wrapper/base_modinput.py", line 127, in stream_events
01-27-2020 14:04:53.842 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/splunk-app-dropbox/bin/dropbox.py" Traceback (most recent call last):
0 Karma

mattalshab
Engager

Just wanted to note that I am seeing 404 errors from splunkd api. Not sure if this could be root cause or the python errors. I should note that there are a bunch of other splunkd api endpoints that do resolve properly (status=202). Have no idea where to go from here. Any thoughts would be appreciated.

SEARCH
index=_internal dropbox host="ourserver" source="/opt/splunk/var/log/splunk/splunkd_access.log" status=404

RESULTS
127.0.0.1 - splunk-system-user [28/Jan/2020:11:45:02.811 -0500] "GET /servicesNS/nobody/splunk-app-dropbox/storage/collections/data/splunk_app_dropbox_checkpointer/splunkv2_cursor HTTP/1.1" 404 140 - - - 2ms
127.0.0.1 - splunk-system-user [28/Jan/2020:11:45:02.046 -0500] "GET /servicesNS/nobody/splunk-app-dropbox/properties/splunk-app-dropbox HTTP/1.1" 404 151 - - - 0ms

0 Karma
Get Updates on the Splunk Community!

Detecting Brute Force Account Takeover Fraud with Splunk

This article is the second in a three-part series exploring advanced fraud detection techniques using Splunk. ...

Buttercup Games: Further Dashboarding Techniques (Part 9)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Buttercup Games: Further Dashboarding Techniques (Part 8)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...