Salesforce Add-on Status 500

[tiagofbmm]

Hello

I am trying to collect a Sandbox Salesforce using the Splunk_Add-on for Salesforce on a HF. The HF machine can reach out to https://test.salesforce.com with status 200, so it seems there is no issue on this.

Still I keep receiving ERRORs about having Invalid Credentials or Network issues.

2018-05-08 07:54:08,213 +0000 log_level=ERROR, pid=18365, tid=MainThread, file=cce_plugin_sfdc.py, func_name=check_login_result, code_line_no=127 | [stanza_name=account] Login Salesforce failed. Please check your network environment and credentials.

2018-05-08 07:54:08,210 +0000 log_level=ERROR, pid=18365, tid=MainThread, file=task.py, func_name=_send_request, code_line_no=441 | [stanza_name=account] Error occurred in request url=https://test.salesforce.com/services/Soap/u/39.0/ method=POST reason=HTTP Error Unable to find the server at test.salesforce.com
Traceback (most recent call last):
File "/opt/splunk/etc/apps/Splunk_TA_salesforce/bin/splunk_ta_salesforce/cloudconnectlib/core/task.py", line 437, in _send_request
response = self._http_client.send(request)
File "/opt/splunk/etc/apps/Splunk_TA_salesforce/bin/splunk_ta_salesforce/cloudconnectlib/core/http.py", line 236, in send
url, request.method, request.headers, request.body
File "/opt/splunk/etc/apps/Splunk_TA_salesforce/bin/splunk_ta_salesforce/cloudconnectlib/core/http.py", line 190, in _retry_send_request_if_needed
raise HTTPError('HTTP Error %s' % str(err))
HTTPError: HTTP Error Unable to find the server at test.salesforce.com

Any ideas how to debug this further?

Thank you

[tiagofbmm · Accepted solution]

The issue was that Splunk HF was requesting DNS for Salesforce endpoint itself, instead of being the Proxy server on top of it doing it. The checkbox to Reverse DNS Proxy actually forces the DNS resolution to be done in the Proxy, which solved the issue.

[koshyk]

seems error is coming from

@cce_pipeline_plugin
def check_login_result(session_id, server_url, response):
    if session_id and server_url:
        return False
    error = regex_search(_FAULT_STRING_REGEX, response) if response else {}
    fault_string = error.get('faultstring', _DEFAULT_ERROR)
    logger.error(fault_string or _DEFAULT_ERROR)
    return True

I would say Enable DEBUG

# local/splunk_ta_salesforce_settings.conf
[logging]
loglevel = DEBUG

[tiagofbmm]

The logging level was already in DEBUG. Any other suggestions how to chase this?