We are attempting to bring the Splunk App for Salesforce into our on-premise Splunk enterprise. When we configured it, it throws the following error:
01-26-2017 18:05:15.808 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/splunk-app-sfdc/bin/sfdc_object.py" Traceback (most recent call last):
01-26-2017 18:05:15.808 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/splunk-app-sfdc/bin/sfdc_object.py" File "/opt/splunk/etc/apps/splunk-app-sfdc/bin/sfdc_object.py", line 395, in <module>
01-26-2017 18:05:15.809 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/splunk-app-sfdc/bin/sfdc_object.py" run()
01-26-2017 18:05:15.809 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/splunk-app-sfdc/bin/sfdc_object.py" File "/opt/splunk/etc/apps/splunk-app-sfdc/bin/sfdc_object.py", line 373, in run
01-26-2017 18:05:15.809 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/splunk-app-sfdc/bin/sfdc_object.py" session, endpoint = get_salesforce_token(settings, config)
01-26-2017 18:05:15.809 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/splunk-app-sfdc/bin/sfdc_object.py" File "/opt/splunk/etc/apps/splunk-app-sfdc/bin/sfdc_object.py", line 227, in get_salesforce_token
01-26-2017 18:05:15.809 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/splunk-app-sfdc/bin/sfdc_object.py" handle = urllib2.urlopen(req)
01-26-2017 18:05:15.809 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/splunk-app-sfdc/bin/sfdc_object.py" File "/opt/splunk/lib/python2.7/urllib2.py", line 154, in urlopen
01-26-2017 18:05:15.809 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/splunk-app-sfdc/bin/sfdc_object.py" return opener.open(url, data, timeout)
01-26-2017 18:05:15.809 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/splunk-app-sfdc/bin/sfdc_object.py" File "/opt/splunk/lib/python2.7/urllib2.py", line 431, in open
01-26-2017 18:05:15.809 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/splunk-app-sfdc/bin/sfdc_object.py" response = self._open(req, data)
01-26-2017 18:05:15.809 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/splunk-app-sfdc/bin/sfdc_object.py" File "/opt/splunk/lib/python2.7/urllib2.py", line 449, in _open
01-26-2017 18:05:15.809 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/splunk-app-sfdc/bin/sfdc_object.py" '_open', req)
01-26-2017 18:05:15.809 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/splunk-app-sfdc/bin/sfdc_object.py" File "/opt/splunk/lib/python2.7/urllib2.py", line 409, in _call_chain
01-26-2017 18:05:15.809 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/splunk-app-sfdc/bin/sfdc_object.py" result = func(*args)
01-26-2017 18:05:15.810 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/splunk-app-sfdc/bin/sfdc_object.py" File "/opt/splunk/lib/python2.7/urllib2.py", line 1240, in https_open
01-26-2017 18:05:15.810 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/splunk-app-sfdc/bin/sfdc_object.py" context=self._context)
01-26-2017 18:05:15.810 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/splunk-app-sfdc/bin/sfdc_object.py" File "/opt/splunk/lib/python2.7/urllib2.py", line 1197, in do_open
01-26-2017 18:05:15.810 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/splunk-app-sfdc/bin/sfdc_object.py" raise URLError(err)
01-26-2017 18:05:15.811 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/splunk-app-sfdc/bin/sfdc_object.py" urllib2.URLError: <urlopen error [Errno -2] Name or service not known>
Unfortunately, this exception is not handled properly, so we don't have insight into what is causing the problem. I tested the username, password, security token, and URL (test.salesforce.com), as well as the request it creates by using those properties, and it is successful. I've even tested using cURL on the server itself without issue. Anyone have some suggestions of what else to look at?
For reference, here's the library that's failing (/opt/splunk/lib/python2.7/urllib2.py):
1180 headers = dict(
1181 (name.title(), val) for name, val in headers.items())
1182
1183 if req._tunnel_host:
1184 tunnel_headers = {}
1185 proxy_auth_hdr = "Proxy-Authorization"
1186 if proxy_auth_hdr in headers:
1187 tunnel_headers[proxy_auth_hdr] = headers[proxy_auth_hdr]
1188 # Proxy-Authorization should not be sent to origin
1189 # server.
1190 del headers[proxy_auth_hdr]
1191 h.set_tunnel(req._tunnel_host, headers=tunnel_headers)
1192
1193 try:
1194 h.request(req.get_method(), req.get_selector(), req.data, headers)
1195 except socket.error, err: # XXX what error?
1196 h.close()
1197 raise URLError(err)
1198 else:
1199 try:
1200 r = h.getresponse(buffering=True)
1201 except TypeError: # buffering kw not supported
1202 r = h.getresponse()
... View more