Talk to Splunk with Amazon Alexa: Why am I getting error "Can't connect to Splunk REST API with the token..." during setup?

[ryanoconnor]

I'm most of the way through the setup of the "Talk to Splunk with Amazon Alexa" App https://splunkbase.splunk.com/app/3298/ but I still have an error.

The messages I keep seeing are:

09-20-2016 15:36:03.930 -0400 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/alexa/bin/alexa.py" Can't connect to Splunk REST API with the token [omitted], either the token is invalid or SplunkD has exited : Connection reset

I'm wondering if this has anything to do with which https port I have chosen? If I am running Splunk on 443, then I need to put Alexa on a different port. My guess is this issue has something to do with confusion of ports and how the underlying app functions. Anyone have any additional insight into this?

[Damien_Dallimor · Accepted solution]

actually only port 443 will currently work as the alexa cloud doesn't allow you to specify a different port

[ryanoconnor]

The answer to this question is basically the following:

Currently Amazon only supports making calls to port 443. As a result, you'll need the Alexa input running on 443 and Splunk will have to run on a different port.

[keilinw]

Running the Alexa listener requires Running Splunk as a privileged user which seems to violate some security principles. Perhaps we can set the listener up on a higher port, run as a non privileged user, and set up a proxy to pass the income 443 requests to the new high port?

[Damien_Dallimor]

Not possible.
AWS don't allow declaring a port other than 443 (although I coded this ability in the Splunk App for future use hopefully)

[Damien_Dallimor]

I added the functionality in the Alexa Splunk App to allow you to choose any https port because the underlying Skills API actually allows you to set this programmatically. However , the Alexa cloud has not caught up to it's own API yet to allow your to configure a port other than 443.Hopefully in future releases.There is certainly chatter in the Alexa forums on this subject.

I'll push an update to the UI and docs to alleviate any confusion.

[ryanoconnor]

Ahh ok so then the config to change the Alexa https port is not to be used right now but maybe in the future? and Splunk would need to run on a different port other than 443?

[Damien_Dallimor]

Yes , that is left in there for future functionality. Only the default port 443 is supported.

BTW : Splunk does not run on port 443. The Modular Input stanza fires up it's own HTTPs web server on port 443 running in a child process of SplunkD.There is an architecture diagram in the docs.

[ryanoconnor]

Alright, I think I almost understand.

In my specific case however, Splunk does run on port 443. I have it set that way and it is a pretty standard configuration.

Are you saying that I can't run Splunk on 443 for this app to work? Can I run Splunk on a non-standard port for it to work?

[ryanoconnor]

Confirmed this actually. When I switched Splunk to run on 8443 and the Alexa app to run on 443, all was well. I'll figure something out for handling the port definition so my user's don't get too confused. Thanks for the help!

[Damien_Dallimor]

This error has nothing to do with your Alexa HTTPS port or stanza setup at all.

This error is in the Modular Input subsystem.It performs call backs to the SplunkD REST API to manage it's lifecycle.Source code.

Just a guess , the cause of the error could be something like not being able to DNS resolve the hostname that your Splunk instance is running on ? Or maybe you have another stanza somewhere in inputs.conf with the same name as what your gave your Alexa stanza ?

[ryanoconnor]

I can triple check DNS is resolvable.

Do you know if I use a custom HTTPS port, should my endpoint URL in the configuration settings include a port designation?

I.e

Splunk running on 443
Alexa input running on 10000

Should my endpoint URL be host:10000/alexa?