All Apps and Add-ons

Script is running but doesn't appear to be collecting any data

adriancblack
New Member

Hi there, having trouble setting up the add-on. It appears to be running...

root      4308  4163  0 18:29 ?        00:00:00 /bin/sh -c python /opt/splunk/etc/apps/NestAddonforSplunk/bin/devices.py
root      4309  4308  0 18:29 ?        00:00:00 python /opt/splunk/etc/apps/NestAddonforSplunk/bin/devices.py
root      4310  4309  0 18:29 ?        00:00:00 python /opt/splunk/etc/apps/NestAddonforSplunk/bin/devices.py
root      4311  4309  0 18:29 ?        00:00:00 python /opt/splunk/etc/apps/NestAddonforSplunk/bin/devices.py

and I obtained my token without issue which is in the file $SPLUNK_HOME/etc/apps/NestAddonforSplunk/local/nest_tokens.conf:

[living_room]
key = c.reYj....[redacted]

but the App doesn't find any data. Is there any debugging output for the script? Searching for 'nest' in splunk doesn't find anything. Any tips would be appreciated, thanks!

0 Karma

ryanoconnor
Builder

This issue is fixed as of version 1.1.0 of the Nest Add-on. Version 1.1.1 also supports OSX

0 Karma

adriancblack
New Member

https://developers.nest.com/documentation/cloud/data-rate-limits/

Seems the python scrypt is not taking into account the 307's that Nest wants you to cache and follow for subsequent requests... and then the rate limits.

0 Karma

jkat54
SplunkTrust
SplunkTrust

Yo @ryanoconnor

0 Karma

ryanoconnor
Builder

Ya I think this is a known issue we discovered recently. Sorry for the late response. We have a fix in the works currently to account for this that we are testing. Currently the only fix is to restart Splunk.

ryanoconnor
Builder

This should be fixed now in v1.1. Release just pushed to Splunkbase!

0 Karma

jdonn_splunk
Splunk Employee
Splunk Employee

I saw this post and realized that I have not set up my Nest in Splunk yet. I had to set the environmental variable for $SPLUNK_HOME in my profile to get it to work. I also removed all of the PID checks in the script, which did not seem to work on OS X.

However, you are not kicking out any errors. Make sure that you have access to the nest index by default under Access Controls. Also, it takes some time before the lookup files are built, so you may just have to look back in after a day.

0 Karma

adriancblack
New Member

This is a good tip as this was initially my problem too initially. The documentation did say you needed to do this, which I added to /etc/environment (on Debian Linux.)

0 Karma

jkat54
SplunkTrust
SplunkTrust

Have you checked your internal index?

index=_internal nest

OR

index=_internal source=*splunkd.log OR source=*python.log

etc

0 Karma

adriancblack
New Member

Thank you, totally forgot to look for output logs in splunk itself. Looking at the logs at when it stopped, don't see anything. Before I had my access token configured correctly the python script was erroring out but after that

The script started working properly on Sept 3 but stopped on Sept 5 for unknown reason. They were still running but no data was being pulled. Restarting Splunk (For another reason) made it start working again.

09-07-2016 13:11:23.959 -0700 INFO  ExecProcessor - New scheduled exec process: python /opt/splunk/etc/apps/NestAddonforSplunk/bin/devices.py
09-03-2016 18:31:40.155 -0700 INFO  ExecProcessor - New scheduled exec process: python /opt/splunk/etc/apps/NestAddonforSplunk/bin/devices.py

Top line is from restarted splunk today and the bottom one is from starting it up when it started working. Very odd.....

0 Karma

jkat54
SplunkTrust
SplunkTrust

hmm it sounds like the python code could be buggy. do you have multiple python processes running when it fails? Like in your task manager, etc?

Sometimes when I'm developing splunk apps, if I dont do something right in my python scripts I end up with a bunch of python threads running and after so many, the scripts stop all together. Restarting splunk kills all the child python processes owned by splunk, and then all is well for a bit until my buggy software falls on it's face again. Usually its do to some unhandled exception or maybe because i need to implement a timeout function, etc.

0 Karma

sundareshr
Legend

Check the query for correct index and sourcetype. To do that, you can either click on Activity>>Jobs (top right of your page) OR click the magnifying glass on the bottom left corner of any panel. That will open the search in a new window with the query it is using. If you find an error, you can edit the dashboard to correct the error.

0 Karma

adriancblack
New Member

Hi there, so looking back the script started running .... It seems pull data about 2 or 3 times a day ... but then after running for about 2 days, it stopped. Looking in the "nest" index I don't see any errors at all, just what appears to be the raw JSON data being pulled from Nest. Checking for the scripts, I saw they were still running just as I left them.

For an unrelated reason I restarted the Splunk service and it's working again... I guess I will monitor and see if it breaks again.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...