All Apps and Add-ons

Syndication Input (RSS/ATOM/RDF) Add-On

paulbannister
Communicator

Since updating to 8.1.1 on our Heavy Forwarder we've been seeing the below error message within the internal logs of the add-on, has anyone else experienced this and aware of a fix?

Traceback (most recent call last): File "/opt/splunk/etc/apps/syndication/bin/modular_input.zip/modular_input/modular_input_base_class.py", line 1095, in execute self.do_run(in_stream, log_exception_and_continue=True) File "/opt/splunk/etc/apps/syndication/bin/modular_input.zip/modular_input/modular_input_base_class.py", line 976, in do_run self.run(stanza, cleaned_params, input_config) File "/opt/splunk/etc/apps/syndication/bin/syndication.py", line 383, in run if last_entry_date_retrieved is not None and last_entry_date_retrieved > last_entry_date: TypeError: '>' not supported between instances of 'time.struct_time' and 'NoneType'

 

@LukeMurphey 

Tags (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Run the Splunk Upgrade Readiness app on that app to verify it is Python3-compatible.  Install a newer version of the app, if there is one.

---
If this reply helps you, Karma would be appreciated.
0 Karma

paulbannister
Communicator

Hi Rich,

Latest available version of the App has been installed and is allegedly compatible with 8.1, we've just been through all the readiness and updates for our environment and nothing came up flagged for the app

Many Thanks


Paul

0 Karma

humayo
Loves-to-Learn Lots

Was there a resolution to this? We have the same error with Splunk Enterprise 8.1.0.1 and the latest Syndication app (1.2.4) 

0 Karma

paulbannister
Communicator

No official resolution as far as I can see, some of our feeds were happy once they were deleted and recreated fresh but not all got fixed in this way, thankfully those ones weren't crucial feeds 

0 Karma

Chikuwa
Explorer

You can fix this by editing syndication/bin/syndication.py as follows:

 

170c170
<         latest_date = None
---
>         latest_date = time.gmtime(0)
343c343
<                 last_entry_date = None
---
>                 last_entry_date = time.gmtime(0)
347c347
<             last_entry_date_retrieved = None
---
>             last_entry_date_retrieved = time.gmtime(0)
383c383
<                 if last_entry_date_retrieved is not None and last_entry_date_retrieved > last_entry_date:
---
>                 if last_entry_date_retrieved !=0 and last_entry_date_retrieved > last_entry_date:

 

 

Mark_D61
Loves-to-Learn

Has anyone found that the fix mentioned by @Chikuwa doesn't work?

After changing out the lines in syndication.py, and restarting Splunk, it fails to load the Addon.

Does anyone have another solution?

I'm using Splunk 8.2.1

*** I want to update this reply***

I deleted all the inputs (2 all up, the first one for another site worked). I then re-added the input for the one that was not working as the only input for syndication, and now it works.

 

 

 

0 Karma

s2233
Explorer

@Mark_D61 can you clarify what you did to get the add-on to appear again? It seems to disappear whenever I attempt to modify syndication.py and restart Splunk.

0 Karma

Chikuwa
Explorer

@Mark_D61What version of the app do you use. The version I mentioned is 1.2.4.

 

Were error messages changed after editing syndication.py?

Let me see the error by executing the search below.

index=_internal sourcetype=syndication_modular_input

 

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...