We updated Splunk to 7.3.3 and the Google Drive app to 2.0.1 yesterday evening, so I'm not sure which, if either is contributing to this problem, but after the updates all messages from sourcetype google_spreadsheet_modular_input look something like this:
2019-12-11 16:49:00,177 ERROR A general exception was thrown when executing the import
Traceback (most recent call last):
File "/opt/splunk/etc/apps/google_drive/bin/google_spreadsheet.py", line 222, in import_file
last_updated = google_lookup_sync.import_to_lookup_file(lookup_name, None, None, spreadsheet_title, worksheet_name, session_key, create_if_non_existent=False)
File "/opt/splunk/etc/apps/google_drive/bin/google_drive_app/__init__.py", line 369, in import_to_lookup_file
return self.import_to_lookup_file_full_path(destination_full_path, namespace, owner, google_spread_sheet_name, worksheet_name, session_key, create_if_non_existent, lookup_name=lookup_name)
File "/opt/splunk/etc/apps/google_drive/bin/google_drive_app/__init__.py", line 387, in import_to_lookup_file_full_path
google_spread_sheet = self.open_google_spreadsheet(google_spread_sheet_name)
File "/opt/splunk/etc/apps/google_drive/bin/google_drive_app/__init__.py", line 151, in open_google_spreadsheet
google_spread_sheet = self.gspread_client.open(title)
File "/opt/splunk/etc/apps/google_drive/bin/google_drive_app/gspread/client.py", line 123, in open
self.list_spreadsheet_files()
File "/opt/splunk/etc/apps/google_drive/bin/google_drive_app/gspread/client.py", line 96, in list_spreadsheet_files
res = self.request('get', url, params=params).json()
File "/opt/splunk/etc/apps/google_drive/bin/google_drive_app/gspread/client.py", line 73, in request
headers=headers
File "/opt/splunk/lib/python2.7/site-packages/requests/sessions.py", line 480, in get
return self.request('GET', url, **kwargs)
TypeError: request() got an unexpected keyword argument 'json'
And no lookups have been updated. Any advice on how to get the import working again would be appreciated, thank you.
It looks like the newer version of the app may not be compatible with the version of the requests library that Splunk 7.3.3 includes. I opened a bug report and am looking into fixing it: https://lukemurphey.net/issues/2540.
Update:
I put in fix in version 2.0.2. You will likely need to restart Splunk for the change to get picked up.
I attempted downgrading to app version 1.0.3 and it appears to work again. I don't know if this is a long-term solution.
It looks like the newer version of the app may not be compatible with the version of the requests library that Splunk 7.3.3 includes. I opened a bug report and am looking into fixing it: https://lukemurphey.net/issues/2540.
Update:
I put in fix in version 2.0.2. You will likely need to restart Splunk for the change to get picked up.
Cool, thank you for the quick response!