httpget command

[melonman]

Hi,

I followed the README for installation. When I used httpget command from search bar, I got following error.

command="httpget", Error : Traceback: Traceback (most recent call last): File "/opt/splunk/etc/system/bin/httpget.py", line 26, in <module> conn.close() NameError: name 'conn' is not defined

Is there anything I need to do for this to make this work?
I am running Splunk5.0.1.

Thank you!

---

[Added for ndoshi's answer]

I checked with new one, and followed README again.

(1) FILENAME in commands.conf should be in lower case.

Possible typo in stanza [httpget] in /Users/mhyugaji/Desktop/spl_instance/splunk/etc/system/local/commands.conf, line 2: FILENAME = httpget.py
* It is working though.

(2) If url field has "http://" in front of URL, no good.

(Working)
* | head 1 | eval url="www.splunk.com" | httpget | table url httpget
* | head 1 | eval url="www.splunk.com:80" | httpget | table url httpget

(Not working and get error)
* | head 1 | eval url="http://www.splunk.com" | httpget | table url httpget

(Not working and no error)
* | head 1 | eval url="http://www.splunk.com:80" | httpget | table url httpget

so, my url fields sometimes has "http://", so I will apply httpget command after removing http://.

[ndoshi · Accepted solution]

Did you follow instructions (README.txt) to create entries in commands.conf and authorize.conf in $SPLUNK_HOME/etc/system/local? You must have if Splunk is not complaining about not finding the command. What is the URL you are trying to test?

If it's not a public URL, can you follow the instructions to index the sample log file that comes with the distribution to test with the URL's in this file to see if that works? I just tested it in Splunk 5 and it worked with the sample. I also had an index called sample. Here's my search:

index="sample" sourcetype="sampleurl"|dedup myurl|eval url=myurl|httpget|table url,httpget

There was a typo in my inputs.conf and I just uploaded a new httpget_command on Splunkbase for this typo.

[melonman]

I checked with your sample data, and realized my url field contain http:// before URL (www.splunk.com e.g.).

Thank you so much!