trying to get the swimlane app working in SplunkES. keep receiving connection errors although the network FWs are allowing the traffic.

[cstarford]

Followed the following documentation for setup:

https://www.secopshub.com/t/managing-splunk-es-notable-events-in-swimlane/135

Receiving the following errors:

11/7/18
12:06:56.925 AM
11-07-2018 00:06:56.925 -0500 ERROR sendmodalert - action=swimlane_action STDERR - Unexpected error: HTTPSConnectionPool(host='*******', port=443): Max retries exceeded with url: /api/user/login (Caused by ConnectTimeoutError(, 'Connection to ******** timed out. (connect timeout=60)'))
host = ******** source = /opt/splunk/var/log/splunk/splunkd.log sourcetype = splunkd
11/7/18
12:06:54.316 AM
11-07-2018 00:06:54.316 -0500 ERROR SearchScheduler - Error in 'sendalert' command: Alert script returned error code 3., search='sendalert swimlane_action results_file="/opt/splunk/var/run/splunk/dispatch/rt_scheduler_adminSplunkEnterpriseSecuritySuiteRMD584a10c448120c834_at_1541564516_68.271_5A305BFB-0AC6-45C1-B4A3-F3F373D89467/results.csv.gz" results_link="https://plspksearch007.bah.com:8000/app/SplunkEnterpriseSecuritySuite/@go?sid=rt_scheduleradminSplunkEnterpriseSecuritySuite_RMD584a10c448120c834_at_1541564516_68.271_5A305BFB-0AC6-45C1-B4A3-F3F373D89467" param.action_name=swimlane_action | stats count'
host = ******* source = /opt/splunk/var/log/splunk/splunkd.log sourcetype = splunkd
11/7/18
12:06:54.264 AM
11-07-2018 00:06:54.264 -0500 ERROR sendmodalert - action=swimlane_action STDERR - Unexpected error: HTTPSConnectionPool(host='******', port=443): Max retries exceeded with url: /api/user/login (Caused by ConnectTimeoutError(, 'Connection to ***** timed out. (connect timeout=60)'))
host = ******** source = /opt/splunk/var/log/splunk/splunkd.log sourcetype = splunkd

Verified the credentials are all correct and firewalls are allowing the traffic.. Can telnet to the swimlane server via 443 from the Splunk ES SH.