Getting Data In

ERROR ChunkedExternProcessor - Failed to find newline while reading transport header.

suser2019
Explorer

I followed the instructions http://dev.splunk.com/view/SP-CAAAFFT and created a custom search command 'snincident' ( app name is SNow-incident-creation and test.py has all the code)
I am making a servicenow api call for incident creation.
when I do the | snincident all i see are errors below

06-14-2019 12:16:49.551 INFO ChunkedExternProcessor - Running process: /opt/splunk/bin/python /opt/splunk/etc/apps/SNow-incident-creation/bin/test.py
06-14-2019 12:16:50.790 ERROR ChunkedExternProcessor - Failed to find newline while reading transport header.
06-14-2019 12:16:50.819 ERROR ChunkedExternProcessor - Error in 'snincident' command: External search command exited unexpectedly.
06-14-2019 12:16:50.819 INFO SearchParser - PARSING: | snincident
06-14-2019 12:16:50.820 INFO ChunkedExternProcessor - Running process: /opt/splunk/bin/python /opt/splunk/etc/apps/SNow-incident-creation/bin/test.py
06-14-2019 12:16:52.458 ERROR ChunkedExternProcessor - Failed to find newline while reading transport header.
06-14-2019 12:16:52.458 ERROR ChunkedExternProcessor - Error in 'snincident' command: External search command exited unexpectedly.
06-14-2019 12:16:52.458 INFO SearchPhaseGenerator - Failed to create phases using AST:Error in 'snincident' command: External search command exited unexpectedly.. Falling back to 2 phase mode.

When I run the command on command line with python for splunk it works :
-bash-4.2$ /opt/splunk/bin/python /opt/splunk/etc/apps/SNow-incident-creation/bin/test.py
{u'result': {u'ticket_number': u'INC3010096', u'ticket_link': u'https://snow-link/nav_to.do?uri=/incident.do?sys_id=520b7b95db4e', u'ticket_id': u'520b7b9', u'get_ticket_record_api': u'https://snow-link/api/now/table/incident/520b7b95db4e77c42bf5453f2996197d?sysparm_display_value=true...}

I am not sure how to fix this issue.

Tags (1)
0 Karma

suser2019
Explorer

any help please.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...