Encountered Winrm module not present issue on Splunk cloud for custom alert action.

[Prajwal_Kasar]

Hello Folks,

I'm encountering an issue with Splunk Cloud where it indicates that the winrm module is not found. I'm attempting to install and run a custom alert action packaged Python application that uses winrm to establish a remote connection to a target server for cleanup processes. However, after installation and testing, I discovered that winrm is not installed in the Splunk Cloud environment used by our organization. Is there any workaround to achieve this and proceed further?

Issue:

ModuleNotFoundError:No module named 'winrm

Script block that uses winrm:

import winrm
import sys
import argparse
import os

def clean_old_files(TargetServer, FolderPath, FileThresholdInMinutes, UserName, Password):
# Initialize return values
deleted_files = []
deleted_count = 0

#print(f"Connecting to server: {TargetServer}...")
#remove above print statement in next deployment.

try:
# Establish a WinRM session
session = winrm.Session(TargetServer, auth=(UserName, Password), transport='ntlm')

#splunkcloud Splunk ITSI Module for Application Performance Monitoring 

[Prajwal_Kasar]

Thank you @livehybrid ,

It did work after installing compatible version for urllib3, However now when I try testing the running the app, I am facing a new issue which says:

'Error: HTTPConnectionPool(host='icia-mesapp1oc.na.pg.com', port=5985): Max retries exceeded with url: /wsman (Caused by NewConnectionError('<urllib3.connection.HTTPConnection object at 0x7f432b936c40>: Failed to establish a new connection: [Errno -2] Name or service not known'))'

I have added all the possible compatible modules and dependencies. 

[livehybrid]

Hi @Prajwal_Kasar

1. Include the WinRM library (and its dependencies) in your app bundle before installing it on Splunk Cloud.

#Within your app
mkdir lib
pip install --target=lib winrm

2. Prepend lib to sys.path in your alert script

# bin/alert_winrm.py - For example
import os, sys
vendor_dir = os.path.join(os.path.dirname(__file__), "../lib")
sys.path.insert(0, vendor_dir)
import winrm

def clean_old_files(TargetServer, FolderPath, FileThresholdInMinutes, UserName, Password):
    session = winrm.Session(TargetServer, auth=(UserName, Password), transport='ntlm')
    # … your cleanup logic …

if __name__ == "__main__":
    # parse args and call clean_old_files()

3. Package & deploy as you would normally

4. Note

• WinRM’s may require additional deps (requests, xmltodict, six) but I think pip should install these.
• Ensure Splunk Cloud can reach your Windows host on port 5985/5986 - this can be managed with ACS.

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[Prajwal_Kasar]

Thank you @livehybrid  for the above solution.
However, Now when I have added the winrm in app directory and deployed on Splunk Cloud, I am getting a new issue 

ImportError: urllib3 v2 only supports OpenSSL 1.1.1+, currently the 'ssl' module is compiled with 'OpenSSL 1.0.2zk-fips  3 Sep 2024'. See: https://github.com/urllib3/urllib3/issues/2168]

And below is how i am importing the winrm

import argparse
import os
import sys
lib_dir = os.path.abspath(os.path.join(os.path.dirname(__file__),'..','lib'))
sys.path.insert(0,lib_dir)
import winrm

def clean_old_files(TargetServer, FolderPath, FileThresholdInMinutes, UserName, Password):

Please guide me how i can overcome this issue.

[livehybrid]

Hi @Prajwal_Kasar 

This means that urllib3 v2.x is not compatible with the version of OpenSSL (1.0.2) installed in your Splunk Cloud Python environment. Even though you may have bundled your own libraries, you can't change the underlying OpenSSL on Splunk Cloud. 

urllib3 v2.0+ dropped support for OpenSSL < 1.1.1 however many environments (including Splunk Cloud's Python and underlying OS) still use OpenSSL 1.0.2.
To fix this you need to Pin urllib3 to v1.x

I would try and install a specific urllib3 package 1.26.18 into your lib/deps folder along with winrm, as 1.26.18 supports OpenSSL 1.0.2.

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[Esky73]

Thanks this fixed my issue importing an SDK into an app

pip install urllib3==1.26.18 --target /opt/splunk/etc/apps/<myApp>/bin --upgrade