Splunk Enterprise

How do I fix in curl requests: curl(77) error?

comcordriro
Explorer

Problem

Getting API data from an external service.

Location script: /opt/splunk/etc/apps/statuscake/bin/statuscake.sh

 

 

 

#!/bin/bash
curl https://api.statuscake.com/v1/pagespeed \
  -H "Authorization: Bearer secretkeyhere"

 

 

 

  1. When running the curl command directly on Linux host, the output of command is working.
  2. When running the script.sh (see above) from the CLI (as splunk user) the output is working.
  3. When running the script by Splunk itself, the output shows only in splunkd.log :

 

 

 

 

09-13-2022 03:21:49.753 +0000 ERROR ExecProcessor [7634 ExecProcessor] - message from "/opt/splunk/etc/apps/statuscake/bin/statuscake_api.sh" \r  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0curl: (77) Problem with the SSL CA cert (path? access rights?)

09-13-2022 03:21:49.649 +0000 ERROR ExecProcessor [7634 ExecProcessor] - message from "/opt/splunk/etc/apps/statuscake/bin/statuscake_api.sh"   % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current

09-13-2022 03:20:49.771 +0000 ERROR ExecProcessor [7634 ExecProcessor] - message from "/opt/splunk/etc/apps/statuscake/bin/statuscake_api.sh" \r  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0curl: (77) Problem with the SSL CA cert (path? access rights?)

 

 

 

 

Tried already (without success)

Updating ca-bundle on CentOS (curl points to right path).

Updated Splunk cert.

Trying to replicate, but curl and the script work without problems as long as they are not being triggered by Splunk.

 

Tags (3)
0 Karma
1 Solution

comcordriro
Explorer

Okay i figured out how to get the script working.

Had to add --cacert option to the command. 

 

 

#!/bin/bash
curl --cacert /etc/pki/tls/certs/ca-bundle.crt https://api.statuscake.com/v1/pagespeed \
  -H "Authorization: Bearer secretkeyhere"

 

 

Apparently when Splunk triggers the script it behaves differently from triggering it manually. Even with same user. When Splunk triggers it, the curl command inside script will use its NSS database (/etc/pki/nssdb). So thats why the --cacert option solves this problem.

I still have no idea whats the deeper logic behind this, but it works this way. 

View solution in original post

bill_kirby
Explorer

Thank you for this, I just encountered a similar issue and your post helped me greatly!

0 Karma

comcordriro
Explorer

Okay i figured out how to get the script working.

Had to add --cacert option to the command. 

 

 

#!/bin/bash
curl --cacert /etc/pki/tls/certs/ca-bundle.crt https://api.statuscake.com/v1/pagespeed \
  -H "Authorization: Bearer secretkeyhere"

 

 

Apparently when Splunk triggers the script it behaves differently from triggering it manually. Even with same user. When Splunk triggers it, the curl command inside script will use its NSS database (/etc/pki/nssdb). So thats why the --cacert option solves this problem.

I still have no idea whats the deeper logic behind this, but it works this way. 

youngsuh
Contributor

Wow!  I've encountered the same.  Thanks for posting.

0 Karma
Get Updates on the Splunk Community!

Monitoring Postgres with OpenTelemetry

Behind every business-critical application, you’ll find databases. These behind-the-scenes stores power ...

Mastering Synthetic Browser Testing: Pro Tips to Keep Your Web App Running Smoothly

To start, if you're new to synthetic monitoring, I recommend exploring this synthetic monitoring overview. In ...

Splunk Edge Processor | Popular Use Cases to Get Started with Edge Processor

Splunk Edge Processor offers more efficient, flexible data transformation – helping you reduce noise, control ...