Hi all,
I have installed Splunk_TA_New_Relic v2.2.0 and configured the NR Insight Input. I did not use HTTP proxy and I could see the following error in the TA logs:
AttributeError: module 'socks' has no attribute 'PROXY_TYPE_HTTP_NO_TUNNEL'
'http_no_tunnel': socks.PROXY_TYPE_HTTP_NO_TUNNEL,
File "/opt/splunk/etc/apps/Splunk_TA_New_Relic/bin/splunk_ta_new_relic/aob_py3/cloudconnectlib/core/http.py", line 26, in <module>
from .http import HttpClient
File "/opt/splunk/etc/apps/Splunk_TA_New_Relic/bin/splunk_ta_new_relic/aob_py3/cloudconnectlib/core/engine.py", line 6, in <module>
from .engine import CloudConnectEngine
Hence the data collector failed with
2020-11-09 22:07:39,251 +0000 log_level=ERROR, pid=27340, tid=Thread-4, file=ta_data_collector.py, func_name=index_data, code_line_no=113 | [stanza_name="NR_Events"] Failed to index data
Does anybody experienced the same issue and know how to resolve it?
Thanks in advance.
This is directly tied to versions of Splunk.. I just came across this today, I have recently updated a heavy forwarder from 8.0.7 to 8.2.0, my previously built apps are still working without issue. I went to create a new barebones REST API app and ran into that exact error message. I compared the folder structure of the python libraries that are tacked on when creating a new app with Add-on Builder and they were entirely different. I ended up making a copy of...
/opt/splunk/etc/apps/<MY APP>/bin/ta_illinois_university_housing_api/aob_py3/httplib2/socks.py
...And placing it one directory level up. This resolved the problem, and also mimics the folder structure of my older apps.
Has anyone (else!) submitted a ticket to Splunk regarding this? Thats a major bug.
I tried what samejgink suggested above and it worked.
I'm facing the same issue, from the error message:
AttributeError: module 'socks' has no attribute 'PROXY_TYPE_HTTP_NO_TUNNEL'
I found that there are two socks.py file in new relic app folder
one is in: /opt/splunk/etc/apps/Splunk_TA_New_Relic/bin/splunk_ta_new_relic
the other one is in: /opt/splunk/etc/apps/Splunk_TA_New_Relic/bin/splunk_ta_new_relic/aob_py3/httplib2
the error message indicates that the issue is regarding file /opt/splunk/etc/apps/Splunk_TA_New_Relic/bin/splunk_ta_new_relic/aob_py3/cloudconnectlib/core/http.py, the socks module is imported by "from httplib2 import socks", it should use the sock.py file in the folder /opt/splunk/etc/apps/Splunk_TA_New_Relic/bin/splunk_ta_new_relic/aob_py3/httplib2, but it's not, after checking the sock.py file in /opt/splunk/etc/apps/Splunk_TA_New_Relic/bin/splunk_ta_new_relic, it doesn't have attribute "PROXY_TYPE_HTTP_NO_TUNNEL"(around line 77), somehow the http.py invoke the wrong socks.py file.
So I just try to rename the sock.py file to other name in folder /opt/splunk/etc/apps/Splunk_TA_New_Relic/bin/splunk_ta_new_relic, issue solved.
This is a workaroud , I don't know what's the effect to rename the sock.py file.
This is directly tied to versions of Splunk.. I just came across this today, I have recently updated a heavy forwarder from 8.0.7 to 8.2.0, my previously built apps are still working without issue. I went to create a new barebones REST API app and ran into that exact error message. I compared the folder structure of the python libraries that are tacked on when creating a new app with Add-on Builder and they were entirely different. I ended up making a copy of...
/opt/splunk/etc/apps/<MY APP>/bin/ta_illinois_university_housing_api/aob_py3/httplib2/socks.py
...And placing it one directory level up. This resolved the problem, and also mimics the folder structure of my older apps.
Has anyone (else!) submitted a ticket to Splunk regarding this? Thats a major bug.
Hi, Can you show the path where you puts the copy for this path?
/opt/splunk/etc/apps/<MY APP>/bin/ta_illinois_university_housing_api/aob_py3/httplib2/socks.py
Thanks. below work around is resolved the problem. However, it's a Major bug and Splunk must resolve it in next release.
Just hit this myself. Were you able to resolve it?
Unfortunately not. This error happened when I tried to ingest events from New Relic. I then resorted to the New Relic NRQL Command for Splunk" add-on to get the data from New relic events.
Hi,
I have the same issue : I've created an add-on with Splunk Add-on builder and it was working fine until I upgraded Splunk to version 8.0.6.
Now I get the following message evertime I run a test :
Traceback (most recent call last):
File "/data/splunk/etc/apps/TA-nexthink/bin/nxengine_dgsi11test_1607030152_560.py", line 14, in <module>
import input_module_nxengine_dgsi11test_1607030152_560 as input_module
File "/splunk/etc/apps/TA-nexthink/bin/input_module_nx11test_1607030152_560.py", line 29, in <module>
from cloudconnectlib.client import CloudConnectClient
File "/splunk/etc/apps/TA-nexthink/bin/ta_nexthink/aob_py3/cloudconnectlib/client.py", line 8, in <module>
from .configuration import get_loader_by_version
File "/splunk/etc/apps/TA-nexthink/bin/ta_nexthink/aob_py3/cloudconnectlib/configuration/__init__.py", line 1, in <module>
from .loader import get_loader_by_version
File "/splunk/etc/apps/TA-nexthink/bin/ta_nexthink/aob_py3/cloudconnectlib/configuration/loader.py", line 15, in <module>
from ..core.exceptions import ConfigException
File "/splunk/etc/apps/TA-nexthink/bin/ta_nexthink/aob_py3/cloudconnectlib/core/__init__.py", line 1, in <module>
from .engine import CloudConnectEngine
File "/splunk/etc/apps/TA-nexthink/bin/ta_nexthink/aob_py3/cloudconnectlib/core/engine.py", line 6, in <module>
from .http import HttpClient
File "/splunk/etc/apps/TA-nexthink/bin/ta_nexthink/aob_py3/cloudconnectlib/core/http.py", line 26, in <module>
'http_no_tunnel': socks.PROXY_TYPE_HTTP_NO_TUNNEL,
AttributeError: module 'socks' has no attribute 'PROXY_TYPE_HTTP_NO_TUNNEL'
Context :
Proxy : none
Url : https
Authentication : basic
I guess it is linked to the upgrade, but the we should not be the only ones to experience this. Anyone else as this ?
I am having the same problem. seems like Splunk is releasing these addons without proper testing
Hi @fulldanad , I'm having the same problem as you.
My version:
Splunk Enterprise
Version: 8.1.3.
Were you able to correct this problem?
I was able to resolve the http tunnel related issue. however i observed a new issue that http calls with requests package is not working and getting 403 forbidden error. the same script was working fine on previous versions. I had rewrite my script using http.client method.
Hi ,
I am facing this problem after upgarde to 8.1.2 with all the custom add-ons.
Anyone who is able to resolve it.
TIA