Syndication Input (RSS/ATOM/RDF) Add-On

[paulbannister]

Since updating to 8.1.1 on our Heavy Forwarder we've been seeing the below error message within the internal logs of the add-on, has anyone else experienced this and aware of a fix?

Traceback (most recent call last): File "/opt/splunk/etc/apps/syndication/bin/modular_input.zip/modular_input/modular_input_base_class.py", line 1095, in execute self.do_run(in_stream, log_exception_and_continue=True) File "/opt/splunk/etc/apps/syndication/bin/modular_input.zip/modular_input/modular_input_base_class.py", line 976, in do_run self.run(stanza, cleaned_params, input_config) File "/opt/splunk/etc/apps/syndication/bin/syndication.py", line 383, in run if last_entry_date_retrieved is not None and last_entry_date_retrieved > last_entry_date: TypeError: '>' not supported between instances of 'time.struct_time' and 'NoneType'

@LukeMurphey 

[richgalloway]

Run the Splunk Upgrade Readiness app on that app to verify it is Python3-compatible.  Install a newer version of the app, if there is one.

[paulbannister]

Hi Rich,

Latest available version of the App has been installed and is allegedly compatible with 8.1, we've just been through all the readiness and updates for our environment and nothing came up flagged for the app

Many Thanks


Paul

[humayo]

Was there a resolution to this? We have the same error with Splunk Enterprise 8.1.0.1 and the latest Syndication app (1.2.4) 

[paulbannister]

No official resolution as far as I can see, some of our feeds were happy once they were deleted and recreated fresh but not all got fixed in this way, thankfully those ones weren't crucial feeds 

[Chikuwa]

You can fix this by editing syndication/bin/syndication.py as follows:

170c170
<         latest_date = None
---
>         latest_date = time.gmtime(0)
343c343
<                 last_entry_date = None
---
>                 last_entry_date = time.gmtime(0)
347c347
<             last_entry_date_retrieved = None
---
>             last_entry_date_retrieved = time.gmtime(0)
383c383
<                 if last_entry_date_retrieved is not None and last_entry_date_retrieved > last_entry_date:
---
>                 if last_entry_date_retrieved !=0 and last_entry_date_retrieved > last_entry_date:

[Mark_D61]

Has anyone found that the fix mentioned by @Chikuwa doesn't work?

After changing out the lines in syndication.py, and restarting Splunk, it fails to load the Addon.

Does anyone have another solution?

I'm using Splunk 8.2.1

*** I want to update this reply***

I deleted all the inputs (2 all up, the first one for another site worked). I then re-added the input for the one that was not working as the only input for syndication, and now it works.

[s2233]

@Mark_D61 can you clarify what you did to get the add-on to appear again? It seems to disappear whenever I attempt to modify syndication.py and restart Splunk.

[Chikuwa]

@Mark_D61What version of the app do you use. The version I mentioned is 1.2.4.

Were error messages changed after editing syndication.py?

Let me see the error by executing the search below.

index=_internal sourcetype=syndication_modular_input