Hi all,
I'm having an issue with the Python SDK. I'm running the latest version of the SDK (1.5.0) on python 2.7.10. Whever I try to connect to my instance I get the following error:
Traceback (most recent call last):
File "event_types.py", line 44, in <module>
main()
File "event_types.py", line 32, in main
service = connect(**opts.kwargs)
File "..\splunklib\client.py", line 321, in connect
s.login()
File "..\splunklib\binding.py", line 847, in login
cookie="1") # In Splunk 6.2+, passing "cookie=1" will return the "set-cookie" header
File "..\splunklib\binding.py", line 1185, in post
return self.request(url, message)
File "..\splunklib\binding.py", line 1202, in request
response = self.handler(url, message, **kwargs)
File "..\splunklib\binding.py", line 1339, in request
response = connection.getresponse()
File "C:\Python27\lib\httplib.py", line 1067, in getresponse
response.begin()
File "C:\Python27\lib\httplib.py", line 409, in begin
version, status, reason = self._read_status()
File "C:\Python27\lib\httplib.py", line 373, in _read_status
raise BadStatusLine(line)
httplib.BadStatusLine: ''
I recently upgraded my Python version. Is there any reason that 2.7.10 wouldn't work with the current version of the SDK? Is there a workaround for this error?
Thanks!
It turns out that updating to Python 2.7.11 fixed the issue. I'm not sure what bug fix might have been addressed in the minor upgrade, but at least we're in a working state now.
It turns out that updating to Python 2.7.11 fixed the issue. I'm not sure what bug fix might have been addressed in the minor upgrade, but at least we're in a working state now.
Didnt see that one coming... good work on the solution! Thanks for working with me!
I'm not 100% sure but I do use Python 2.7.10 myself without issue. So I don't think the upgrade is the problem. It could be related because they handle your object a bit differently etc. It's just unlikely.
If we focus on the error message, it's says it's getting a bad status message from the httplib request. Its expecting a code like 2xx,3xx,4xx,5xx (404 page not found for example), but instead it's getting something unexpected and falling into an exception case.
I think if you try to use curl from the same affected machine to the same server, you might get more details. Maybe you'll get a very strange error message related to tcp stack corruption, no route to host, etc. Can you try curling the server fr the machine and post the response you get?
Ah, so I'm not getting any response when trying to use an http scheme. When I switch to https, the curl works fine, but the SDK still exits with an error. The error is different though:
Traceback (most recent call last):
File "event_types.py", line 44, in <module>
main()
File "event_types.py", line 32, in main
service = connect(**opts.kwargs)
File "..\splunklib\client.py", line 321, in connect
s.login()
File "..\splunklib\binding.py", line 847, in login
cookie="1") # In Splunk 6.2+, passing "cookie=1" will return the "set-cookie" header
File "..\splunklib\binding.py", line 1185, in post
return self.request(url, message)
File "..\splunklib\binding.py", line 1202, in request
response = self.handler(url, message, **kwargs)
File "..\splunklib\binding.py", line 1334, in request
connection = connect(scheme, host, port)
File "..\splunklib\binding.py", line 1317, in connect
kwargs['context'] = ssl._create_unverified_context()
AttributeError: 'module' object has no attribute '_create_unverified_context'
Do I need to update a separate package for compatibility with the Splunk SDK?
Can you show me the code you're using complete with the server address etc. ?
Please mask the domain or IP address but I'm interested in the port numbers, and the syntax and the actual code.
I'm just running the event_types.py file (under the examples folder with the Splunk SDK release) with my environment variables specified.
import sys, os
sys.path.insert(0, os.path.join(os.path.dirname(__file__), ".."))
from splunklib.client import connect
try:
from utils import parse
except ImportError:
raise Exception("Add the SDK repository to your PYTHONPATH to run the examples "
"(e.g., export PYTHONPATH=~/splunk-sdk-python.")
def main():
opts = parse(sys.argv[1:], {}, ".splunkrc")
service = connect(**opts.kwargs)
for item in service.event_types:
print "%s" % item.name
print '='*len(item.name)
content = item.content
for key in sorted(content.keys()):
value = content[key]
print "%s: %s" % (key, value)
print
if __name__ == "__main__":
main()
Here is what is in my .splunkrc file:
host=mySplunk
port=8089
username=admin
password=myPassword
scheme=https
version=6.3
Ah, it's failing based on your opts.kwargs (which is read from you .splunkrc file).
File "event_types.py", line 32, in main
service = connect(**opts.kwargs)
Sorry but I was on a mobile phone earlier. Something in your keyword arguments maybe isnt "cool".
Do you have a strong password with special characters etc? If so, try surrounding the values with single or double quotes like this:
host='myhost'
port='8089'
username='admin'
password='my$pec!@lP@ssw0rd!'
scheme=https #<-unfortunately I dont know if this is correct, maybe needs to be ssl, im looking at httplib2 now (what splunk uses in the connect() function)
version=6.3 #<-unfortunately I dont know if its needed, maybe try commenting it out and testing
Hey, are you using splunk free for this? If so, i think that is the problem. Looks like this can be related to unsupported ssl ciphers that are used in the trial version. You can download a splunk enterprise trial and test with it instead if so.
I'm using a full enterprise instance.
@jkat54 Thanks for all the help here. I upgraded to Python 2.7.11 and it seems to have fixed the issue. Still unclear what might have been fixed in the upgrade, but I assume it's something in the ssl module.
No difference, unfortunately. I still get the same error on the same line.