All Apps and Add-ons

Splunk Add-on Builder REST API Test Error - Content purported to be compressed with default but failed to decompress

ejwade
Communicator

In the Splunk Add-on Builder, I configured a modular input using a REST API to pull data from FortiOS/FortiGate. I tested my REST URL and received the following error message:

[ERROR] - [test] HTTPError reason=HTTP Error Content purported to be compressed with deflate but failed to decompress. when sending request to url=https://x.x.x.x/api/v2/cmdb/firewall/address?with_meta=true&vdom=*&access_token=xxxxxxxxxxxxx method=GET

When I tested the URL in a browser, the JSON comes back fine. Authentication takes place in the URL via the access_token parameter. Any ideas on how to get around this compression error?

Here is the full log:

2020-03-19 19:42:56,347 - test_fortigate_configuration_firewall_addresses - [ERROR] - [test] HTTPError reason=HTTP Error Content purported to be compressed with deflate but failed to decompress. when sending request to url=https://x.x.x.x/api/v2/cmdb/firewall/address?with_meta=true&vdom=*&access_token=xxxxxxxxxxxxx method=GET
Traceback (most recent call last):
  File "/opt/splunk/etc/apps/sherlock_fortigate-config_ta/bin/sherlock_fortigate_config_ta/aob_py3/httplib2/__init__.py", line 455, in _decompressContent
    content = zlib.decompress(content, -zlib.MAX_WBITS)
zlib.error: Error -3 while decompressing data: invalid stored block lengths
During handling of the above exception, another exception occurred:
Traceback (most recent call last):
  File "/opt/splunk/etc/apps/sherlock_fortigate-config_ta/bin/sherlock_fortigate_config_ta/aob_py3/cloudconnectlib/core/http.py", line 224, in _retry_send_request_if_needed
    uri=uri, body=body, method=method, headers=headers
  File "/opt/splunk/etc/apps/sherlock_fortigate-config_ta/bin/sherlock_fortigate_config_ta/aob_py3/cloudconnectlib/core/http.py", line 195, in _send_internal
    uri, body=body, method=method, headers=headers
  File "/opt/splunk/etc/apps/sherlock_fortigate-config_ta/bin/sherlock_fortigate_config_ta/aob_py3/httplib2/__init__.py", line 1957, in request
    cachekey,
  File "/opt/splunk/etc/apps/sherlock_fortigate-config_ta/bin/sherlock_fortigate_config_ta/aob_py3/httplib2/__init__.py", line 1622, in _request
    conn, request_uri, method, body, headers
  File "/opt/splunk/etc/apps/sherlock_fortigate-config_ta/bin/sherlock_fortigate_config_ta/aob_py3/httplib2/__init__.py", line 1592, in _conn_request
    content = _decompressContent(response, content)
  File "/opt/splunk/etc/apps/sherlock_fortigate-config_ta/bin/sherlock_fortigate_config_ta/aob_py3/httplib2/__init__.py", line 466, in _decompressContent
    content,
httplib2.FailedToDecompressContent: Content purported to be compressed with deflate but failed to decompress.
During handling of the above exception, another exception occurred:
Traceback (most recent call last):
  File "/opt/splunk/etc/apps/sherlock_fortigate-config_ta/bin/sherlock_fortigate_config_ta/aob_py3/cloudconnectlib/core/engine.py", line 291, in _send_request
    response = self._client.send(request)
  File "/opt/splunk/etc/apps/sherlock_fortigate-config_ta/bin/sherlock_fortigate_config_ta/aob_py3/cloudconnectlib/core/http.py", line 275, in send
    url, request.method, request.headers, request.body
  File "/opt/splunk/etc/apps/sherlock_fortigate-config_ta/bin/sherlock_fortigate_config_ta/aob_py3/cloudconnectlib/core/http.py", line 229, in _retry_send_request_if_needed
    raise HTTPError('HTTP Error %s' % str(err))
cloudconnectlib.core.exceptions.HTTPError: HTTP Error Content purported to be compressed with deflate but failed to decompress.
2020-03-19 19:42:56,347 - test_fortigate_configuration_firewall_addresses - [INFO] - [test] This job need to be terminated.
2020-03-19 19:42:56,347 - test_fortigate_configuration_firewall_addresses - [INFO] - [test] Job processing finished
2020-03-19 19:42:56,347 - test_fortigate_configuration_firewall_addresses - [INFO] - [test] 1 job(s) process finished
2020-03-19 19:42:56,347 - test_fortigate_configuration_firewall_addresses - [INFO] - [test] Engine executing finished
0 Karma

laurie_gellatly
Communicator

This appears to be telling you that the result being returned is compressed but it can't be deflated.
Are you setting anything in the request that says you accept a compressed result?

0 Karma

ejwade
Communicator

@laurie_gellatly - the request does not have any parameters specifying whether or not to compress. The error message I get from the add-on builder suggests the content claims to be compressed, but the add-on builder's scripts failed to decompress. I think this is mostly likely a bug in the add-on builder, because when I plug the URL into a browser the JSON comes back fine.

0 Karma
Get Updates on the Splunk Community!

SOAR Tenable.sc scan endpoint with credentials

When scanning an endpoint in SOAR how to you get a credential scan? I can start a scan via SOAR playbook but ...

KVStore failure after upgrade to 9.0

After upgrading to Splunk 9.0 on a single instance, we occasionally get KV Store errors.&nbsp;<span ...

Is there an add-on for the Cisco Meraki devices?

We have many&nbsp;Cisco Meraki devices sending data via syslog to Splunk. Is there an add-on for ...