Monitoring Splunk

Using python external lookup An error occurs when requesting an HTTPS website

bestSplunker
Contributor

I have a simple external lookup python script that implements a simple post request and returns the result to the splunk search.I know the script will call splunk built-in python, so I suspect that there is a problem with the built-in ssl library , which causes the script to fail to request the https website.

When running python script with module requests to get https response,it occurrs a error 'NoneType' object has no attribute 'wrap_socket'.

alt text

If I put splunk's python executable file (/opt/splunk/bin/python2.7 ) soft link to linux os python, everything works fine. However, some functions of splunk become unusable. For example, splunk will return an error when creating a new user. This is because I changed the soft link of the splunk python executable. So I can't modify splunk's python program at random.

So how to solve this problem? Who can provide an example of an external lookup script that requests the https website?

all help would be greatly appreciated.

splunk verson 6.4.3

Tags (1)
0 Karma
1 Solution

MuS
Legend

The easiest option would be to place the OS requests module into your apps bin directory so this will be loaded. Another option is to insert the OS Python module path before the Splunk Python module path in your script.

I did both previously in Python scripts and it work just fine.

cheers, MuS

View solution in original post

0 Karma

MuS
Legend

The easiest option would be to place the OS requests module into your apps bin directory so this will be loaded. Another option is to insert the OS Python module path before the Splunk Python module path in your script.

I did both previously in Python scripts and it work just fine.

cheers, MuS

0 Karma

bestSplunker
Contributor

@MuS Good answer, I hope I can recommend your answer, because you write a comment, I can not recommend your answer.

0 Karma

MuS
Legend

Converted to answer 😉

cheers, MuS

0 Karma

nickhills
Ultra Champion

As you have noticed, you should not try to replace/link the python packages with that of the local OS - bad things will happen.

If my comment helps, please give it a thumbs up!
0 Karma

bestSplunker
Contributor

@nickhillscpl OK,So is splunk's built-in SSL lib in wrong ? Have you ever used external lookups to request HTTPS websites? Have you ever encountered such a problem?

0 Karma
Get Updates on the Splunk Community!

From Alert to Resolution: How Splunk Observability Helps SREs Navigate Critical ...

It's 3:17 AM, and your phone buzzes with an urgent alert. Wire transfer processing times have spiked, and ...

ATTENTION!! We’re MOVING (not really)

Hey, all! In an effort to keep this Slack workspace secure and also to make our new members' experience easy, ...

Splunk Admins: Build a Smarter Stack with These Must-See .conf25 Sessions

  Whether you're running a complex Splunk deployment or just getting your bearings as a new admin, .conf25 ...