Monitoring Splunk

anyone familiar with this error in splunkd for o365 TA

Bentash
Explorer

10-23-2019 00:30:50.477 +0000 ERROR PersistentScript - From {/opt/splunk/bin/python /opt/splunk/lib/python2.7/site-packages/splunk/persistconn/appserver.py}: /opt/splunk/etc/apps/splunk_ta_o365/bin/3rdparty/urllib3/connectionpool.py:846: InsecureRequestWarning: Unverified HTTPS request is being made. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#ssl-warnings
10-23-2019 00:30:50.477 +0000 ERROR PersistentScript - From {/opt/splunk/bin/python /opt/splunk/lib/python2.7/site-packages/splunk/persistconn/appserver.py}: InsecureRequestWarning)

Tags (1)
0 Karma

Nekomimi
Observer

Hi,

Has anyone found the solution to this yet?

0 Karma

MuS
Legend

Hi Bentash,

If I recall it correct this (using an unverified SSL connection) was done to prevent data collection issues in case of any SSL certs issues in o365/Azure. It tells you that the SSL certificate is not validated.

Long story short, this is not really an error more a warning and should be reported as such like the actual python error tells you it is just a warning : InsecureRequestWarning

Hope this helps ...

cheers, MuS

0 Karma

a212830
Champion

I'm no sure that I'd call this something to ignore. Don't we want to use validated SSL certificates?

0 Karma

MuS
Legend

Well, it come all down to two options:

  1. accept the fact that you will loss events if you enable the SSL verification and something happens in Azure which invalidates the certificate
  2. accept the less secure connection when not verifying the certificate but continue to get events even something happens in Azure which invalidates the certificate

cheers, MuS

0 Karma

a212830
Champion

Agreed. I think the secure connection is important.

0 Karma

MuS
Legend

In this case the error message actually tells you what to do 😉

10-23-2019 00:30:50.477 +0000 ERROR PersistentScript - From {/opt/splunk/bin/python /opt/splunk/lib/python2.7/site-packages/splunk/persistconn/appserver.py}: /opt/splunk/etc/apps/splunk_ta_o365/bin/3rdparty/urllib3/connectionpool.py:846: InsecureRequestWarning: Unverified HTTPS request is being made. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#ssl-warnings

cheers, MuS

0 Karma

mmqt
Path Finder

In the same boat, unable to pull any data now

0 Karma

twellinghurst
Engager

I'm getting this same error. Have you found any solution?

0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with Paul Stout

Welcome to our very first developer spotlight release series where we'll feature some awesome Splunk ...

State of Splunk Careers 2024: Maximizing Career Outcomes and the Continued Value of ...

For the past four years, Splunk has partnered with Enterprise Strategy Group to conduct a survey that gauges ...

Data-Driven Success: Splunk & Financial Services

Splunk streamlines the process of extracting insights from large volumes of data. In this fast-paced world, ...