Developing for Splunk Enterprise

Install pyOpenSSL and boto3 for a single app? Drag and drop doesn't work because of missing dependencies.

Path Finder

To this point in time, every time we needed to make a python module available to a single app in Splunk, we would drag and drop the python modules into $SPLUNKHOME/etc/apps/APPNAME/bin/MODULE . This has worked until we needed the pyOpenSSL and boto3 libraries which have lots of cryptography and single script dependencies that don't come over correctly.

What I've tried:

1| python3 -m venv $SPLUNKHOME/etc/apps/APPNAME/
2| python3 -m pip install (pyOpenSSL, boxsdk, pyJWT, boto3) < base dependencies
3| move $SPLUNKHOME/etc/apps/APPNAME/lib/python3.7/site-packages/ > $/SPLUNKHOME/etc/apps/APPNAME/bin
4| Put all my app scripts in $/SPLUNKHOME/etc/apps/APPNAME/bin alongside all the modules I just installed to that folder using venv
5| Start Splunk
6| search | search_command arg=0

At this point, Splunk tells me that the enum34, ipaddress, chainmap, cryptography (constanttime module buried in here somewhere doesn't exist where it should) modules don't exist.

I then shut down Splunk, redid steps 1-6 but also installing all those missing modules on step 2. The error I'm getting now is this:
External search command 'boxfiles' returned error code 1. First 1000 (of 1456) bytes of script output: "No module named constanttime ERROR "Error 'No module named constanttime'. Traceback (most recent call last): File ""/Applications/Splunk/etc/apps/TA-box-connector/bin/boxconnector/init.py"", line 3, in from boxconnector import BoxConnector File ""/Applications/Splunk/etc/apps/TA-box-connector/bin/boxconnector/boxconnector.py"", line 10, in from OpenSSL import crypto File ""/Applications/Splunk/etc/apps/TA-box-connector/bin/OpenSSL/init.py"", line 8, in from OpenSSL import crypto, SSL File ""/Applications/Splunk/etc/apps/TA-box-connector/bin/OpenSSL/crypto.py"", line 12, in from cryptography import x509 File ""/Applications/Splunk/etc/apps/TA-box-connector/bin/cryptography/x509/init.py"", line 8, in from cryptography.x509.base import ( File ""/Applications/Splunk/etc/apps/TA-box-connector/bin/cryptography/x509/base.py"", line 18, in from cryptography.x509.extensions import Exte".

I'd like to solve this error, but I've been working through this dependency issue for some time now, so if there's a better solution to getting these packages on here, I would love to hear about it.

Labels (3)
0 Karma

Observer

This is an issue for our app as well, I see that Splunk has pyOpenSSL documented in the 7.2 toolkit, but easily extending an app to use this module or incorporating it on the app lib folder has proven difficult

 

https://docs.splunk.com/Documentation/StreamApp/7.2.0/ReleaseNotes/OpenSSLEncryptionToolkit

0 Karma