Monitoring Splunk

anyone familiar with this error in splunkd for o365 TA

Bentash
Explorer

10-23-2019 00:30:50.477 +0000 ERROR PersistentScript - From {/opt/splunk/bin/python /opt/splunk/lib/python2.7/site-packages/splunk/persistconn/appserver.py}: /opt/splunk/etc/apps/splunk_ta_o365/bin/3rdparty/urllib3/connectionpool.py:846: InsecureRequestWarning: Unverified HTTPS request is being made. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#ssl-warnings
10-23-2019 00:30:50.477 +0000 ERROR PersistentScript - From {/opt/splunk/bin/python /opt/splunk/lib/python2.7/site-packages/splunk/persistconn/appserver.py}: InsecureRequestWarning)

Tags (1)
0 Karma

Nekomimi
Observer

Hi,

Has anyone found the solution to this yet?

0 Karma

MuS
Legend

Hi Bentash,

If I recall it correct this (using an unverified SSL connection) was done to prevent data collection issues in case of any SSL certs issues in o365/Azure. It tells you that the SSL certificate is not validated.

Long story short, this is not really an error more a warning and should be reported as such like the actual python error tells you it is just a warning : InsecureRequestWarning

Hope this helps ...

cheers, MuS

0 Karma

a212830
Champion

I'm no sure that I'd call this something to ignore. Don't we want to use validated SSL certificates?

0 Karma

MuS
Legend

Well, it come all down to two options:

  1. accept the fact that you will loss events if you enable the SSL verification and something happens in Azure which invalidates the certificate
  2. accept the less secure connection when not verifying the certificate but continue to get events even something happens in Azure which invalidates the certificate

cheers, MuS

0 Karma

a212830
Champion

Agreed. I think the secure connection is important.

0 Karma

MuS
Legend

In this case the error message actually tells you what to do 😉

10-23-2019 00:30:50.477 +0000 ERROR PersistentScript - From {/opt/splunk/bin/python /opt/splunk/lib/python2.7/site-packages/splunk/persistconn/appserver.py}: /opt/splunk/etc/apps/splunk_ta_o365/bin/3rdparty/urllib3/connectionpool.py:846: InsecureRequestWarning: Unverified HTTPS request is being made. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#ssl-warnings

cheers, MuS

0 Karma

mmqt
Path Finder

In the same boat, unable to pull any data now

0 Karma

twellinghurst
Engager

I'm getting this same error. Have you found any solution?

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Boston may be buzzing this September with Splunk University and .conf25, but you don’t have to pack a bag to ...

Splunk Lantern’s Guide to The Most Popular .conf25 Sessions

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Unlock What’s Next: The Splunk Cloud Platform at .conf25

In just a few days, Boston will be buzzing as the Splunk team and thousands of community members come together ...