All Apps and Add-ons

Syndication Input (RSS/ATOM/RDF) Add-On

paulbannister
Communicator

Since updating to 8.1.1 on our Heavy Forwarder we've been seeing the below error message within the internal logs of the add-on, has anyone else experienced this and aware of a fix?

Traceback (most recent call last): File "/opt/splunk/etc/apps/syndication/bin/modular_input.zip/modular_input/modular_input_base_class.py", line 1095, in execute self.do_run(in_stream, log_exception_and_continue=True) File "/opt/splunk/etc/apps/syndication/bin/modular_input.zip/modular_input/modular_input_base_class.py", line 976, in do_run self.run(stanza, cleaned_params, input_config) File "/opt/splunk/etc/apps/syndication/bin/syndication.py", line 383, in run if last_entry_date_retrieved is not None and last_entry_date_retrieved > last_entry_date: TypeError: '>' not supported between instances of 'time.struct_time' and 'NoneType'

 

@LukeMurphey 

Tags (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Run the Splunk Upgrade Readiness app on that app to verify it is Python3-compatible.  Install a newer version of the app, if there is one.

---
If this reply helps you, Karma would be appreciated.
0 Karma

paulbannister
Communicator

Hi Rich,

Latest available version of the App has been installed and is allegedly compatible with 8.1, we've just been through all the readiness and updates for our environment and nothing came up flagged for the app

Many Thanks


Paul

0 Karma

humayo
Loves-to-Learn Lots

Was there a resolution to this? We have the same error with Splunk Enterprise 8.1.0.1 and the latest Syndication app (1.2.4) 

0 Karma

paulbannister
Communicator

No official resolution as far as I can see, some of our feeds were happy once they were deleted and recreated fresh but not all got fixed in this way, thankfully those ones weren't crucial feeds 

0 Karma

Chikuwa
Explorer

You can fix this by editing syndication/bin/syndication.py as follows:

 

170c170
<         latest_date = None
---
>         latest_date = time.gmtime(0)
343c343
<                 last_entry_date = None
---
>                 last_entry_date = time.gmtime(0)
347c347
<             last_entry_date_retrieved = None
---
>             last_entry_date_retrieved = time.gmtime(0)
383c383
<                 if last_entry_date_retrieved is not None and last_entry_date_retrieved > last_entry_date:
---
>                 if last_entry_date_retrieved !=0 and last_entry_date_retrieved > last_entry_date:

 

 

Mark_D61
Loves-to-Learn

Has anyone found that the fix mentioned by @Chikuwa doesn't work?

After changing out the lines in syndication.py, and restarting Splunk, it fails to load the Addon.

Does anyone have another solution?

I'm using Splunk 8.2.1

*** I want to update this reply***

I deleted all the inputs (2 all up, the first one for another site worked). I then re-added the input for the one that was not working as the only input for syndication, and now it works.

 

 

 

0 Karma

s2233
Explorer

@Mark_D61 can you clarify what you did to get the add-on to appear again? It seems to disappear whenever I attempt to modify syndication.py and restart Splunk.

0 Karma

Chikuwa
Explorer

@Mark_D61What version of the app do you use. The version I mentioned is 1.2.4.

 

Were error messages changed after editing syndication.py?

Let me see the error by executing the search below.

index=_internal sourcetype=syndication_modular_input

 

0 Karma
Get Updates on the Splunk Community!

Thanks for the Memories! Splunk University, .conf24, and Community Connections

Thank you to everyone in the Splunk Community who joined us for .conf24 – starting with Splunk University and ...

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...