All Apps and Add-ons

Unhandled Exception in Splunk App for Salesforce: "urllib2.URLError: urlopen error [Errno -2] Name or service not known"

msaltzman_ondec
Explorer

We are attempting to bring the Splunk App for Salesforce into our on-premise Splunk enterprise. When we configured it, it throws the following error:

01-26-2017 18:05:15.808 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/splunk-app-sfdc/bin/sfdc_object.py" Traceback (most recent call last):
01-26-2017 18:05:15.808 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/splunk-app-sfdc/bin/sfdc_object.py"   File "/opt/splunk/etc/apps/splunk-app-sfdc/bin/sfdc_object.py", line 395, in <module>
01-26-2017 18:05:15.809 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/splunk-app-sfdc/bin/sfdc_object.py"     run()
01-26-2017 18:05:15.809 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/splunk-app-sfdc/bin/sfdc_object.py"   File "/opt/splunk/etc/apps/splunk-app-sfdc/bin/sfdc_object.py", line 373, in run
01-26-2017 18:05:15.809 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/splunk-app-sfdc/bin/sfdc_object.py"     session, endpoint = get_salesforce_token(settings, config)
01-26-2017 18:05:15.809 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/splunk-app-sfdc/bin/sfdc_object.py"   File "/opt/splunk/etc/apps/splunk-app-sfdc/bin/sfdc_object.py", line 227, in get_salesforce_token
01-26-2017 18:05:15.809 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/splunk-app-sfdc/bin/sfdc_object.py"     handle = urllib2.urlopen(req)
01-26-2017 18:05:15.809 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/splunk-app-sfdc/bin/sfdc_object.py"   File "/opt/splunk/lib/python2.7/urllib2.py", line 154, in urlopen
01-26-2017 18:05:15.809 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/splunk-app-sfdc/bin/sfdc_object.py"     return opener.open(url, data, timeout)
01-26-2017 18:05:15.809 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/splunk-app-sfdc/bin/sfdc_object.py"   File "/opt/splunk/lib/python2.7/urllib2.py", line 431, in open
01-26-2017 18:05:15.809 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/splunk-app-sfdc/bin/sfdc_object.py"     response = self._open(req, data)
01-26-2017 18:05:15.809 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/splunk-app-sfdc/bin/sfdc_object.py"   File "/opt/splunk/lib/python2.7/urllib2.py", line 449, in _open
01-26-2017 18:05:15.809 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/splunk-app-sfdc/bin/sfdc_object.py"     '_open', req)
01-26-2017 18:05:15.809 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/splunk-app-sfdc/bin/sfdc_object.py"   File "/opt/splunk/lib/python2.7/urllib2.py", line 409, in _call_chain
01-26-2017 18:05:15.809 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/splunk-app-sfdc/bin/sfdc_object.py"     result = func(*args)
01-26-2017 18:05:15.810 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/splunk-app-sfdc/bin/sfdc_object.py"   File "/opt/splunk/lib/python2.7/urllib2.py", line 1240, in https_open
01-26-2017 18:05:15.810 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/splunk-app-sfdc/bin/sfdc_object.py"     context=self._context)
01-26-2017 18:05:15.810 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/splunk-app-sfdc/bin/sfdc_object.py"   File "/opt/splunk/lib/python2.7/urllib2.py", line 1197, in do_open
01-26-2017 18:05:15.810 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/splunk-app-sfdc/bin/sfdc_object.py"     raise URLError(err)
01-26-2017 18:05:15.811 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/splunk-app-sfdc/bin/sfdc_object.py" urllib2.URLError: <urlopen error [Errno -2] Name or service not known>

Unfortunately, this exception is not handled properly, so we don't have insight into what is causing the problem. I tested the username, password, security token, and URL (test.salesforce.com), as well as the request it creates by using those properties, and it is successful. I've even tested using cURL on the server itself without issue. Anyone have some suggestions of what else to look at?

For reference, here's the library that's failing (/opt/splunk/lib/python2.7/urllib2.py):

1180         headers = dict(
1181             (name.title(), val) for name, val in headers.items())
1182
1183         if req._tunnel_host:
1184             tunnel_headers = {}
1185             proxy_auth_hdr = "Proxy-Authorization"
1186             if proxy_auth_hdr in headers:
1187                 tunnel_headers[proxy_auth_hdr] = headers[proxy_auth_hdr]
1188                 # Proxy-Authorization should not be sent to origin
1189                 # server.
1190                 del headers[proxy_auth_hdr]
1191             h.set_tunnel(req._tunnel_host, headers=tunnel_headers)
1192
1193         try:
1194             h.request(req.get_method(), req.get_selector(), req.data, headers)
1195         except socket.error, err: # XXX what error?
1196             h.close()
1197             raise URLError(err)
1198         else:
1199             try:
1200                 r = h.getresponse(buffering=True)
1201             except TypeError: # buffering kw not supported
1202                 r = h.getresponse()
0 Karma
1 Solution

msaltzman_ondec
Explorer

Took me a bit, but I solved my own problem. Was a typo in the sfdc.conf file. What it was:

[sfdc_account]
password = ******
server = test.salesforce.com
token = *****
username = ******
proxy_url = None

What it should be:
[sfdc_account]
password = ******
server = test.salesforce.com
token = *****
username = ******
proxy_url =

Thanks to @ehaddad for the clues! It was caused by my automation software adding the text None instead of using it as the null value it represents. Oops 😄

View solution in original post

0 Karma

msaltzman_ondec
Explorer

Took me a bit, but I solved my own problem. Was a typo in the sfdc.conf file. What it was:

[sfdc_account]
password = ******
server = test.salesforce.com
token = *****
username = ******
proxy_url = None

What it should be:
[sfdc_account]
password = ******
server = test.salesforce.com
token = *****
username = ******
proxy_url =

Thanks to @ehaddad for the clues! It was caused by my automation software adding the text None instead of using it as the null value it represents. Oops 😄

0 Karma

aaraneta_splunk
Splunk Employee
Splunk Employee

@msaltzman_ondeck - Glad you were able to find the solution to your question. Please don't forget to click "Accept" to resolve your post. Thanks!

0 Karma

ehaddad_splunk
Splunk Employee
Splunk Employee

are you using 2.6.2 version of the app?
when you type index=sfdc is there anything returned?

0 Karma

msaltzman_ondec
Explorer

Version 2.6.2 is correct. Unfortunately since this exception isn't handled, it kills the script when it's hit. This occurs for all objects and events. Nothing is in the index.

0 Karma

ehaddad_splunk
Splunk Employee
Splunk Employee

Looks like it could be a proxy issue. Did you check if you can get to the internet without proxy? Try to telnet from cmd or check browser setting on HWF.

0 Karma

msaltzman_ondec
Explorer

telnet output:
$ telnet test.salesforce.com 443
Trying 96.43.149.120...
Connected to test.gslb2.salesforce.com.
Escape character is '^]'.

There shouldn't be any proxy in the way afiak, but I don't have a browser installed, since this is a linux system to test. If you recommend it still, I will though.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...