All Apps and Add-ons

Splunk_TA_New_Relic Insight not ingesting data

a_hadiwidjaja
Explorer

Hi all,

I have installed Splunk_TA_New_Relic v2.2.0 and configured the NR Insight Input. I did not use HTTP proxy and I could see the following error in the TA logs:

AttributeError: module 'socks' has no attribute 'PROXY_TYPE_HTTP_NO_TUNNEL' 

'http_no_tunnel': socks.PROXY_TYPE_HTTP_NO_TUNNEL,

File "/opt/splunk/etc/apps/Splunk_TA_New_Relic/bin/splunk_ta_new_relic/aob_py3/cloudconnectlib/core/http.py", line 26, in <module>

from .http import HttpClient

File "/opt/splunk/etc/apps/Splunk_TA_New_Relic/bin/splunk_ta_new_relic/aob_py3/cloudconnectlib/core/engine.py", line 6, in <module>

from .engine import CloudConnectEngine

Hence the data collector failed with 

2020-11-09 22:07:39,251 +0000 log_level=ERROR, pid=27340, tid=Thread-4, file=ta_data_collector.py, func_name=index_data, code_line_no=113 | [stanza_name="NR_Events"] Failed to index data

Does anybody experienced the same issue and know how to resolve it?

Thanks in advance.

 

Labels (1)
0 Karma
1 Solution

samejgink
Explorer

This is directly tied to versions of Splunk.. I just came across this today, I have recently updated a heavy forwarder from 8.0.7 to 8.2.0, my previously built apps are still working without issue. I went to create a new barebones REST API app and ran into that exact error message. I compared the folder structure of the python libraries that are tacked on when creating a new app with Add-on Builder and they were entirely different. I ended up making a copy of...

/opt/splunk/etc/apps/<MY APP>/bin/ta_illinois_university_housing_api/aob_py3/httplib2/socks.py

...And placing it one directory level up. This resolved the problem, and also mimics the folder structure of my older apps.
Has anyone (else!) submitted a ticket to Splunk regarding this? Thats a major bug.

View solution in original post

a_hadiwidjaja
Explorer

I tried what samejgink suggested above and it worked.

0 Karma

namesjc
Engager

I'm facing the same issue, from the error message:

AttributeError: module 'socks' has no attribute 'PROXY_TYPE_HTTP_NO_TUNNEL' 

I found that there are two socks.py file in new relic app folder

one is in: /opt/splunk/etc/apps/Splunk_TA_New_Relic/bin/splunk_ta_new_relic

the other one is in: /opt/splunk/etc/apps/Splunk_TA_New_Relic/bin/splunk_ta_new_relic/aob_py3/httplib2

the error message indicates that the issue is regarding file /opt/splunk/etc/apps/Splunk_TA_New_Relic/bin/splunk_ta_new_relic/aob_py3/cloudconnectlib/core/http.py, the socks module is imported by "from httplib2 import socks", it should use the sock.py file in the folder /opt/splunk/etc/apps/Splunk_TA_New_Relic/bin/splunk_ta_new_relic/aob_py3/httplib2, but it's not, after checking the sock.py file in /opt/splunk/etc/apps/Splunk_TA_New_Relic/bin/splunk_ta_new_relic, it doesn't have attribute "PROXY_TYPE_HTTP_NO_TUNNEL"(around line 77), somehow the http.py invoke the wrong socks.py file.

So I just try to rename the sock.py file to other name  in folder /opt/splunk/etc/apps/Splunk_TA_New_Relic/bin/splunk_ta_new_relic, issue solved.

This is a workaroud , I don't know what's the effect to rename the sock.py file.

samejgink
Explorer

This is directly tied to versions of Splunk.. I just came across this today, I have recently updated a heavy forwarder from 8.0.7 to 8.2.0, my previously built apps are still working without issue. I went to create a new barebones REST API app and ran into that exact error message. I compared the folder structure of the python libraries that are tacked on when creating a new app with Add-on Builder and they were entirely different. I ended up making a copy of...

/opt/splunk/etc/apps/<MY APP>/bin/ta_illinois_university_housing_api/aob_py3/httplib2/socks.py

...And placing it one directory level up. This resolved the problem, and also mimics the folder structure of my older apps.
Has anyone (else!) submitted a ticket to Splunk regarding this? Thats a major bug.

adri2915
Observer

Hi, Can you show the path where you puts the copy for this path?

/opt/splunk/etc/apps/<MY APP>/bin/ta_illinois_university_housing_api/aob_py3/httplib2/socks.py

0 Karma

josh12121984
Engager

Thanks. below work around is resolved the problem. However, it's a Major bug and Splunk must resolve it in next release.

0 Karma

davidbann
Explorer

Just hit this myself. Were you able to resolve it?

0 Karma

a_hadiwidjaja
Explorer

Unfortunately not. This error happened when I tried to ingest events from New Relic. I then resorted to the New Relic NRQL Command for Splunk" add-on to get the data from New relic events.

https://splunkbase.splunk.com/app/4988/

0 Karma

fulldanad
Path Finder

Hi, 

I have the same issue : I've created an add-on with Splunk Add-on builder and it was working fine until I upgraded Splunk to version 8.0.6.

Now I get the following message evertime I run a test : 

Traceback (most recent call last):
File "/data/splunk/etc/apps/TA-nexthink/bin/nxengine_dgsi11test_1607030152_560.py", line 14, in <module>
import input_module_nxengine_dgsi11test_1607030152_560 as input_module
File "/splunk/etc/apps/TA-nexthink/bin/input_module_nx11test_1607030152_560.py", line 29, in <module>
from cloudconnectlib.client import CloudConnectClient
File "/splunk/etc/apps/TA-nexthink/bin/ta_nexthink/aob_py3/cloudconnectlib/client.py", line 8, in <module>
from .configuration import get_loader_by_version
File "/splunk/etc/apps/TA-nexthink/bin/ta_nexthink/aob_py3/cloudconnectlib/configuration/__init__.py", line 1, in <module>
from .loader import get_loader_by_version
File "/splunk/etc/apps/TA-nexthink/bin/ta_nexthink/aob_py3/cloudconnectlib/configuration/loader.py", line 15, in <module>
from ..core.exceptions import ConfigException
File "/splunk/etc/apps/TA-nexthink/bin/ta_nexthink/aob_py3/cloudconnectlib/core/__init__.py", line 1, in <module>
from .engine import CloudConnectEngine
File "/splunk/etc/apps/TA-nexthink/bin/ta_nexthink/aob_py3/cloudconnectlib/core/engine.py", line 6, in <module>
from .http import HttpClient
File "/splunk/etc/apps/TA-nexthink/bin/ta_nexthink/aob_py3/cloudconnectlib/core/http.py", line 26, in <module>
'http_no_tunnel': socks.PROXY_TYPE_HTTP_NO_TUNNEL,
AttributeError: module 'socks' has no attribute 'PROXY_TYPE_HTTP_NO_TUNNEL'

 

Context :

Proxy : none

Url : https

Authentication : basic

 

I guess it is linked to the upgrade, but the we should not be the only ones to experience this. Anyone else as this ?

josh12121984
Engager

I am having the same problem. seems like Splunk is releasing these addons without proper testing

0 Karma

wmiscio
Observer

Hi @fulldanad , I'm having the same problem as you.

My version:

Splunk Enterprise
Version: 8.1.3.

Were you able to correct this problem?

0 Karma

josh12121984
Engager

I was able to resolve the http tunnel related issue. however i observed a new issue that http calls with requests package is not working and getting 403 forbidden error. the same script was working fine on previous versions. I had rewrite  my script  using http.client method. 

0 Karma

kalyaniadm_wipr
Loves-to-Learn

Hi ,

I am facing this problem after upgarde to 8.1.2 with all the custom add-ons.

Anyone who is able to resolve it.

TIA

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...