Unhandled Exception in Splunk App for Salesforce: "urllib2.URLError: urlopen error [Errno -2] Name or service not known"

[msaltzman_ondec]

We are attempting to bring the Splunk App for Salesforce into our on-premise Splunk enterprise. When we configured it, it throws the following error:

01-26-2017 18:05:15.808 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/splunk-app-sfdc/bin/sfdc_object.py" Traceback (most recent call last):
01-26-2017 18:05:15.808 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/splunk-app-sfdc/bin/sfdc_object.py"   File "/opt/splunk/etc/apps/splunk-app-sfdc/bin/sfdc_object.py", line 395, in <module>
01-26-2017 18:05:15.809 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/splunk-app-sfdc/bin/sfdc_object.py"     run()
01-26-2017 18:05:15.809 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/splunk-app-sfdc/bin/sfdc_object.py"   File "/opt/splunk/etc/apps/splunk-app-sfdc/bin/sfdc_object.py", line 373, in run
01-26-2017 18:05:15.809 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/splunk-app-sfdc/bin/sfdc_object.py"     session, endpoint = get_salesforce_token(settings, config)
01-26-2017 18:05:15.809 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/splunk-app-sfdc/bin/sfdc_object.py"   File "/opt/splunk/etc/apps/splunk-app-sfdc/bin/sfdc_object.py", line 227, in get_salesforce_token
01-26-2017 18:05:15.809 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/splunk-app-sfdc/bin/sfdc_object.py"     handle = urllib2.urlopen(req)
01-26-2017 18:05:15.809 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/splunk-app-sfdc/bin/sfdc_object.py"   File "/opt/splunk/lib/python2.7/urllib2.py", line 154, in urlopen
01-26-2017 18:05:15.809 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/splunk-app-sfdc/bin/sfdc_object.py"     return opener.open(url, data, timeout)
01-26-2017 18:05:15.809 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/splunk-app-sfdc/bin/sfdc_object.py"   File "/opt/splunk/lib/python2.7/urllib2.py", line 431, in open
01-26-2017 18:05:15.809 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/splunk-app-sfdc/bin/sfdc_object.py"     response = self._open(req, data)
01-26-2017 18:05:15.809 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/splunk-app-sfdc/bin/sfdc_object.py"   File "/opt/splunk/lib/python2.7/urllib2.py", line 449, in _open
01-26-2017 18:05:15.809 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/splunk-app-sfdc/bin/sfdc_object.py"     '_open', req)
01-26-2017 18:05:15.809 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/splunk-app-sfdc/bin/sfdc_object.py"   File "/opt/splunk/lib/python2.7/urllib2.py", line 409, in _call_chain
01-26-2017 18:05:15.809 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/splunk-app-sfdc/bin/sfdc_object.py"     result = func(*args)
01-26-2017 18:05:15.810 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/splunk-app-sfdc/bin/sfdc_object.py"   File "/opt/splunk/lib/python2.7/urllib2.py", line 1240, in https_open
01-26-2017 18:05:15.810 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/splunk-app-sfdc/bin/sfdc_object.py"     context=self._context)
01-26-2017 18:05:15.810 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/splunk-app-sfdc/bin/sfdc_object.py"   File "/opt/splunk/lib/python2.7/urllib2.py", line 1197, in do_open
01-26-2017 18:05:15.810 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/splunk-app-sfdc/bin/sfdc_object.py"     raise URLError(err)
01-26-2017 18:05:15.811 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/splunk-app-sfdc/bin/sfdc_object.py" urllib2.URLError: <urlopen error [Errno -2] Name or service not known>

Unfortunately, this exception is not handled properly, so we don't have insight into what is causing the problem. I tested the username, password, security token, and URL (test.salesforce.com), as well as the request it creates by using those properties, and it is successful. I've even tested using cURL on the server itself without issue. Anyone have some suggestions of what else to look at?

For reference, here's the library that's failing (/opt/splunk/lib/python2.7/urllib2.py):

1180         headers = dict(
1181             (name.title(), val) for name, val in headers.items())
1182
1183         if req._tunnel_host:
1184             tunnel_headers = {}
1185             proxy_auth_hdr = "Proxy-Authorization"
1186             if proxy_auth_hdr in headers:
1187                 tunnel_headers[proxy_auth_hdr] = headers[proxy_auth_hdr]
1188                 # Proxy-Authorization should not be sent to origin
1189                 # server.
1190                 del headers[proxy_auth_hdr]
1191             h.set_tunnel(req._tunnel_host, headers=tunnel_headers)
1192
1193         try:
1194             h.request(req.get_method(), req.get_selector(), req.data, headers)
1195         except socket.error, err: # XXX what error?
1196             h.close()
1197             raise URLError(err)
1198         else:
1199             try:
1200                 r = h.getresponse(buffering=True)
1201             except TypeError: # buffering kw not supported
1202                 r = h.getresponse()

[msaltzman_ondec · Accepted solution]

Took me a bit, but I solved my own problem. Was a typo in the sfdc.conf file. What it was:

[sfdc_account]
password = ******
server = test.salesforce.com
token = *****
username = ******
proxy_url = None

What it should be:
[sfdc_account]
password = ******
server = test.salesforce.com
token = *****
username = ******
proxy_url =

Thanks to @ehaddad for the clues! It was caused by my automation software adding the text None instead of using it as the null value it represents. Oops 😄

[aaraneta_splunk]

@msaltzman_ondeck - Glad you were able to find the solution to your question. Please don't forget to click "Accept" to resolve your post. Thanks!

[ehaddad_splunk]

are you using 2.6.2 version of the app?
when you type index=sfdc is there anything returned?

[msaltzman_ondec]

Version 2.6.2 is correct. Unfortunately since this exception isn't handled, it kills the script when it's hit. This occurs for all objects and events. Nothing is in the index.

[ehaddad_splunk]

Looks like it could be a proxy issue. Did you check if you can get to the internet without proxy? Try to telnet from cmd or check browser setting on HWF.

[msaltzman_ondec]

telnet output:
$ telnet test.salesforce.com 443
Trying 96.43.149.120...
Connected to test.gslb2.salesforce.com.
Escape character is '^]'.

There shouldn't be any proxy in the way afiak, but I don't have a browser installed, since this is a linux system to test. If you recommend it still, I will though.