All Apps and Add-ons
Highlighted

Splunk Add-on Builder REST API Test Error - Content purported to be compressed with default but failed to decompress

Communicator

In the Splunk Add-on Builder, I configured a modular input using a REST API to pull data from FortiOS/FortiGate. I tested my REST URL and received the following error message:

[ERROR] - [test] HTTPError reason=HTTP Error Content purported to be compressed with deflate but failed to decompress. when sending request to url=https://x.x.x.x/api/v2/cmdb/firewall/address?with_meta=true&vdom=*&access_token=xxxxxxxxxxxxx method=GET

When I tested the URL in a browser, the JSON comes back fine. Authentication takes place in the URL via the access_token parameter. Any ideas on how to get around this compression error?

Here is the full log:

2020-03-19 19:42:56,347 - test_fortigate_configuration_firewall_addresses - [ERROR] - [test] HTTPError reason=HTTP Error Content purported to be compressed with deflate but failed to decompress. when sending request to url=https://x.x.x.x/api/v2/cmdb/firewall/address?with_meta=true&vdom=*&access_token=xxxxxxxxxxxxx method=GET
Traceback (most recent call last):
  File "/opt/splunk/etc/apps/sherlock_fortigate-config_ta/bin/sherlock_fortigate_config_ta/aob_py3/httplib2/__init__.py", line 455, in _decompressContent
    content = zlib.decompress(content, -zlib.MAX_WBITS)
zlib.error: Error -3 while decompressing data: invalid stored block lengths
During handling of the above exception, another exception occurred:
Traceback (most recent call last):
  File "/opt/splunk/etc/apps/sherlock_fortigate-config_ta/bin/sherlock_fortigate_config_ta/aob_py3/cloudconnectlib/core/http.py", line 224, in _retry_send_request_if_needed
    uri=uri, body=body, method=method, headers=headers
  File "/opt/splunk/etc/apps/sherlock_fortigate-config_ta/bin/sherlock_fortigate_config_ta/aob_py3/cloudconnectlib/core/http.py", line 195, in _send_internal
    uri, body=body, method=method, headers=headers
  File "/opt/splunk/etc/apps/sherlock_fortigate-config_ta/bin/sherlock_fortigate_config_ta/aob_py3/httplib2/__init__.py", line 1957, in request
    cachekey,
  File "/opt/splunk/etc/apps/sherlock_fortigate-config_ta/bin/sherlock_fortigate_config_ta/aob_py3/httplib2/__init__.py", line 1622, in _request
    conn, request_uri, method, body, headers
  File "/opt/splunk/etc/apps/sherlock_fortigate-config_ta/bin/sherlock_fortigate_config_ta/aob_py3/httplib2/__init__.py", line 1592, in _conn_request
    content = _decompressContent(response, content)
  File "/opt/splunk/etc/apps/sherlock_fortigate-config_ta/bin/sherlock_fortigate_config_ta/aob_py3/httplib2/__init__.py", line 466, in _decompressContent
    content,
httplib2.FailedToDecompressContent: Content purported to be compressed with deflate but failed to decompress.
During handling of the above exception, another exception occurred:
Traceback (most recent call last):
  File "/opt/splunk/etc/apps/sherlock_fortigate-config_ta/bin/sherlock_fortigate_config_ta/aob_py3/cloudconnectlib/core/engine.py", line 291, in _send_request
    response = self._client.send(request)
  File "/opt/splunk/etc/apps/sherlock_fortigate-config_ta/bin/sherlock_fortigate_config_ta/aob_py3/cloudconnectlib/core/http.py", line 275, in send
    url, request.method, request.headers, request.body
  File "/opt/splunk/etc/apps/sherlock_fortigate-config_ta/bin/sherlock_fortigate_config_ta/aob_py3/cloudconnectlib/core/http.py", line 229, in _retry_send_request_if_needed
    raise HTTPError('HTTP Error %s' % str(err))
cloudconnectlib.core.exceptions.HTTPError: HTTP Error Content purported to be compressed with deflate but failed to decompress.
2020-03-19 19:42:56,347 - test_fortigate_configuration_firewall_addresses - [INFO] - [test] This job need to be terminated.
2020-03-19 19:42:56,347 - test_fortigate_configuration_firewall_addresses - [INFO] - [test] Job processing finished
2020-03-19 19:42:56,347 - test_fortigate_configuration_firewall_addresses - [INFO] - [test] 1 job(s) process finished
2020-03-19 19:42:56,347 - test_fortigate_configuration_firewall_addresses - [INFO] - [test] Engine executing finished
0 Karma
Highlighted

Re: Splunk Add-on Builder REST API Test Error - Content purported to be compressed with default but failed to decompress

Communicator

This appears to be telling you that the result being returned is compressed but it can't be deflated.
Are you setting anything in the request that says you accept a compressed result?

0 Karma
Highlighted

Re: Splunk Add-on Builder REST API Test Error - Content purported to be compressed with default but failed to decompress

Communicator

@laurie_gellatly - the request does not have any parameters specifying whether or not to compress. The error message I get from the add-on builder suggests the content claims to be compressed, but the add-on builder's scripts failed to decompress. I think this is mostly likely a bug in the add-on builder, because when I plug the URL into a browser the JSON comes back fine.

0 Karma