Splunk_TA_New_Relic Insight not ingesting data

[a_hadiwidjaja]

Hi all,

I have installed Splunk_TA_New_Relic v2.2.0 and configured the NR Insight Input. I did not use HTTP proxy and I could see the following error in the TA logs:

AttributeError: module 'socks' has no attribute 'PROXY_TYPE_HTTP_NO_TUNNEL' 

'http_no_tunnel': socks.PROXY_TYPE_HTTP_NO_TUNNEL,

File "/opt/splunk/etc/apps/Splunk_TA_New_Relic/bin/splunk_ta_new_relic/aob_py3/cloudconnectlib/core/http.py", line 26, in <module>

from .http import HttpClient

File "/opt/splunk/etc/apps/Splunk_TA_New_Relic/bin/splunk_ta_new_relic/aob_py3/cloudconnectlib/core/engine.py", line 6, in <module>

from .engine import CloudConnectEngine

Hence the data collector failed with 

2020-11-09 22:07:39,251 +0000 log_level=ERROR, pid=27340, tid=Thread-4, file=ta_data_collector.py, func_name=index_data, code_line_no=113 | [stanza_name="NR_Events"] Failed to index data

Does anybody experienced the same issue and know how to resolve it?

Thanks in advance.

[a_hadiwidjaja]

I tried what samejgink suggested above and it worked.

[namesjc]

I'm facing the same issue, from the error message:

AttributeError: module 'socks' has no attribute 'PROXY_TYPE_HTTP_NO_TUNNEL' 

I found that there are two socks.py file in new relic app folder

one is in: /opt/splunk/etc/apps/Splunk_TA_New_Relic/bin/splunk_ta_new_relic

the other one is in: /opt/splunk/etc/apps/Splunk_TA_New_Relic/bin/splunk_ta_new_relic/aob_py3/httplib2

the error message indicates that the issue is regarding file /opt/splunk/etc/apps/Splunk_TA_New_Relic/bin/splunk_ta_new_relic/aob_py3/cloudconnectlib/core/http.py, the socks module is imported by "from httplib2 import socks", it should use the sock.py file in the folder /opt/splunk/etc/apps/Splunk_TA_New_Relic/bin/splunk_ta_new_relic/aob_py3/httplib2, but it's not, after checking the sock.py file in /opt/splunk/etc/apps/Splunk_TA_New_Relic/bin/splunk_ta_new_relic, it doesn't have attribute "PROXY_TYPE_HTTP_NO_TUNNEL"(around line 77), somehow the http.py invoke the wrong socks.py file.

So I just try to rename the sock.py file to other name  in folder /opt/splunk/etc/apps/Splunk_TA_New_Relic/bin/splunk_ta_new_relic, issue solved.

This is a workaroud , I don't know what's the effect to rename the sock.py file.

[samejgink · Accepted solution]

This is directly tied to versions of Splunk.. I just came across this today, I have recently updated a heavy forwarder from 8.0.7 to 8.2.0, my previously built apps are still working without issue. I went to create a new barebones REST API app and ran into that exact error message. I compared the folder structure of the python libraries that are tacked on when creating a new app with Add-on Builder and they were entirely different. I ended up making a copy of...

/opt/splunk/etc/apps/<MY APP>/bin/ta_illinois_university_housing_api/aob_py3/httplib2/socks.py

...And placing it one directory level up. This resolved the problem, and also mimics the folder structure of my older apps.
Has anyone (else!) submitted a ticket to Splunk regarding this? Thats a major bug.

[adri2915]

Hi, Can you show the path where you puts the copy for this path?

/opt/splunk/etc/apps/<MY APP>/bin/ta_illinois_university_housing_api/aob_py3/httplib2/socks.py

[josh12121984]

Thanks. below work around is resolved the problem. However, it's a Major bug and Splunk must resolve it in next release.

[davidbann]

Just hit this myself. Were you able to resolve it?

[a_hadiwidjaja]

Unfortunately not. This error happened when I tried to ingest events from New Relic. I then resorted to the New Relic NRQL Command for Splunk" add-on to get the data from New relic events.

https://splunkbase.splunk.com/app/4988/

[fulldanad]

Hi, 

I have the same issue : I've created an add-on with Splunk Add-on builder and it was working fine until I upgraded Splunk to version 8.0.6.

Now I get the following message evertime I run a test : 

Traceback (most recent call last):
File "/data/splunk/etc/apps/TA-nexthink/bin/nxengine_dgsi11test_1607030152_560.py", line 14, in <module>
import input_module_nxengine_dgsi11test_1607030152_560 as input_module
File "/splunk/etc/apps/TA-nexthink/bin/input_module_nx11test_1607030152_560.py", line 29, in <module>
from cloudconnectlib.client import CloudConnectClient
File "/splunk/etc/apps/TA-nexthink/bin/ta_nexthink/aob_py3/cloudconnectlib/client.py", line 8, in <module>
from .configuration import get_loader_by_version
File "/splunk/etc/apps/TA-nexthink/bin/ta_nexthink/aob_py3/cloudconnectlib/configuration/__init__.py", line 1, in <module>
from .loader import get_loader_by_version
File "/splunk/etc/apps/TA-nexthink/bin/ta_nexthink/aob_py3/cloudconnectlib/configuration/loader.py", line 15, in <module>
from ..core.exceptions import ConfigException
File "/splunk/etc/apps/TA-nexthink/bin/ta_nexthink/aob_py3/cloudconnectlib/core/__init__.py", line 1, in <module>
from .engine import CloudConnectEngine
File "/splunk/etc/apps/TA-nexthink/bin/ta_nexthink/aob_py3/cloudconnectlib/core/engine.py", line 6, in <module>
from .http import HttpClient
File "/splunk/etc/apps/TA-nexthink/bin/ta_nexthink/aob_py3/cloudconnectlib/core/http.py", line 26, in <module>
'http_no_tunnel': socks.PROXY_TYPE_HTTP_NO_TUNNEL,
AttributeError: module 'socks' has no attribute 'PROXY_TYPE_HTTP_NO_TUNNEL'

Context :

Proxy : none

Url : https

Authentication : basic

I guess it is linked to the upgrade, but the we should not be the only ones to experience this. Anyone else as this ?

[josh12121984]

I am having the same problem. seems like Splunk is releasing these addons without proper testing

[wmiscio]

Hi @fulldanad , I'm having the same problem as you.

My version:

Splunk Enterprise
Version: 8.1.3.

Were you able to correct this problem?

[josh12121984]

I was able to resolve the http tunnel related issue. however i observed a new issue that http calls with requests package is not working and getting 403 forbidden error. the same script was working fine on previous versions. I had rewrite  my script  using http.client method. 

[kalyaniadm_wipr]

Hi ,

I am facing this problem after upgarde to 8.1.2 with all the custom add-ons.

Anyone who is able to resolve it.

TIA