Splunk Dev

splunk-sdk-python-1.2.2 -> stop working after upgrading to Splunk 6.0 from Splunk 4.3

lpolo
Motivator

After upgrading to Splunk 6.X all our python scripts that use the latest version of splunk sdk “splunk-sdk-python-1.2.2” stop working. The error we constantly get is the following:

ssl.SSLError: [Errno 1] _ssl.c:492: error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol

Has anyone faced this issue?
How did you solve it?

These are the connection parameters we used.

HOST = "myhost.com"
PORT = 8089
USERNAME = "myaccountid"
PASSWORD = "mypassword"
OWNER = "myaccountid"
APP = "search"

# Create a Service instance and log in
service = client.connect(
    host=HOST,
    port=PORT,
    username=USERNAME,
    password=PASSWORD,
    app=APP,
    owner=OWNER,
    )

After a couple of tests and reading the splunk sdk API. I realized that https scheme is the default in splunklib.client.connect. However, after the upgrade it looks like the splunk admin disabled the support of https. So the issue was solved as follow:

HOST = "myhost.com"
PORT = 8089
USERNAME = "myaccountid"
PASSWORD = "mypassword"
OWNER = "myaccountid"
SCHEME = "http"
APP = "search"

# Create a Service instance and log in
service = client.connect(
    host=HOST,
    port=PORT,
    username=USERNAME,
    password=PASSWORD,
    app=APP,
    owner=OWNER,
    scheme=SCHEME
    )
0 Karma

sloshburch
Splunk Employee
Splunk Employee

I've seen that before when non SSL forwarders try to connect to an SSL indexer (or vice versa - I forget which). The point is, I got that error message while working with basic splunk features, not even with the python SDK.

Anyway - I bet if you make sure everyone's talking the same thing (SSL or http) then you'll find the issue is resolved. Maybe the latest splunk defaults to SSL and the python code you have is still talking http? I'd also remove any sslPassword fields to force splunk to regen them...just for good measure.

0 Karma

i2sheri
Communicator

also when requireClientCert=true is enabled the service = client.connect() fails
any information on this ?

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...