All Apps and Add-ons
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results forย 
Search instead forย 
Did you mean:ย 
Ask a Question

Why is my simple Twitter REST API data input not generating any data?

not_Ian
Engager
โ€Ž08-30-2015 08:29 PM

I followed these (two!) guides for making a Twitter input and have checked everything thrice:

http://blogs.splunk.com/2014/07/03/splunking-social-media-tracking-tweets/ and
http://discoveredintelligence.ca/stream-twitter-splunk-10-simple-steps/

Additionally, I downloaded a Twitter App onto Splunk that needed no configuration and it isn't receiving any data either. I've also been getting unknown error codes in splunkd.log:

08-30-2015 22:26:23.320 -0500 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/twitter2/bin/streamtweets.py" </head>
08-30-2015 22:26:23.320 -0500 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/twitter2/bin/streamtweets.py" <body>
08-30-2015 22:26:23.321 -0500 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/twitter2/bin/streamtweets.py" <h2>HTTP ERROR: 401<h2>
08-30-2015 22:26:23.321 -0500 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/twitter2/bin/streamtweets.py" <p>Problem accessing '/1.1/statuses/sample.json'. Reason:
08-30-2015 22:26:23.321 -0500 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/twitter2/bin/streamtweets.py" </pre/>Unauthorized</pre>
08-30-2015 22:26:23.321 -0500 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/twitter2/bin/streamtweets.py" </body>
08-30-2015 22:26:23.321 -0500 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/twitter2/bin/streamtweets.py" </html>
08-30-2015 22:26:23.625 -0500 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/twitter2/bin/streamtweets.py" Twitter reported status code 401: Unable to decode response, not vaild JSON.

I altered some of the HTML coding so it displayed properly. I also forwarded ports 8000 and 8089 which didn't affect anything. Would a DNS server affect this?

Please, help! Any advice will be appreciated!

0 Karma
Reply

Damien_Dallimor
Ultra Champion
โ€Ž08-30-2015 10:18 PM

Twitter may have changed their authentication logic since those blogs were written.

The current Authentication process is described here.

As this authentication scheme is Twitter specific , you would need to create a Custom Authentication Handler and apply this to the REST API Modular Input stanza you are setting up. The Twitter docs are very comprehensive for the logic require to implement this Authentication logic.

A related answer for custom authentication handlers is mentioned here.

Reply

Damien_Dallimor
Ultra Champion
โ€Ž08-30-2015 09:03 PM

You pasted an error dump from 1 App (Twitter App onto Splunk) , and then you've referred to a totally different App (REST API Modular Input) in the question tag and links to blogs.

Which App do you want to get working ?

Note : any errors for the REST API Modular Input are searchable with :

index=_internal ExecProcessor error rest.py
Reply

not_Ian
Engager
โ€Ž08-30-2015 09:47 PM

This is the error the REST API Modular Input is giving me and a screenshot of the info I have in my REST input.

08-31-2015 00:33:37.341 -0500 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/rest_ta/bin/rest.py" HTTP Request error: 401 Client Error: Authorization Required

alt text

Reply