splunk forwarder not send data to python socket.io

[hammad_yasir]

Hi i hope everyone will be fine.i am facing issue .I am forwarding logs to third party like port of any system.i seen error message at port i am using python third party library scoket.io i face error "code 400, message Bad request version ('nCurrent=0')".help me to solve my issue.with python standard libraray name socket work fine with splunk.when i use with scoket.io libraray its crate error bad request.

eroor.png

[hammad_yasir]

/opt/splunkforwarder/etc/system/local

[tcpout]
defaultGroup = default-autolb-group

[tcpout:default-autolb-group]
server = 192.168.20.185:4845
sendCookedData = false
[tcpout-server://192.168.20.185:4845]

[PickleRick]

Now it's more like it. So you're trying to send events via tcpout output which uses proprietary s2s protocol to your wsgi app which expects http.

With sufficiently new forwarder you could try to set up http forwarding.

https://docs.splunk.com/Documentation/Forwarder/8.2.2/Forwarder/Configureforwardingwithoutputs.conf#...

[PickleRick]

What exactly are you trying to do?

How do you have it configured?

[hammad_yasir]

at python side i have write code

import eventlet
import socketio

sio = socketio.Server()
app = socketio.WSGIApp(sio, static_files={
    '/': {'content_type': 'text/html', 'filename': 'index.html'}
})

@sio.event
def connect(sid, environ):
    print('connect ', sid)

@sio.event
def my_message(sid, data):
    print('message ', data)

@sio.event
def disconnect(sid):
    print('disconnect ', sid)

if __name__ == '__main__':
    eventlet.wsgi.server(eventlet.listen(('192.168.20.185', 4848)), app)