This issue in our install was a timeout waiting for data to return from the Dropbox API. While confirming that the API worked via Postman, I noted that it took a significant amount of time for the call to return. Checking the DEBUG logs from the TA showed the following ConnectionError.
ConnectionError: HTTPSConnectionPool(host='api.dropboxapi.com', port=443): Max retries exceeded with url: /2/team_log/get_events (Caused by ReadTimeoutError("HTTPSConnectionPool(host='api.dropboxapi.com', port=443): Read timed out. (read timeout=5.0)",))
I found that this 5.0 was the default, as defined in /splunk-app-dropbox/bin/splunk_app_dropbox/modinput_wrapper/base_modinput.py
:param timeout: (optional) How long to wait for the server to send data before giving up, as a float, or a (connect timeout, read timeout) tuple. Default to (10.0, 5.0).
I found the call inside input_module_dropbox.py and updated it from timeout=None to timeout=30.0, as below. This gave the call 30 seconds complete, which seemed to be enough.
# call Dropbox API
response = helper.send_http_request(url,
'POST',
parameters=None,
payload=payload,
headers=headers,
cookies=None,
verify=True,
cert=None,
**timeout=None,**
use_proxy=False,
)
Updated to:
# call Dropbox API
response = helper.send_http_request(url,
'POST',
parameters=None,
payload=payload,
headers=headers,
cookies=None,
verify=True,
cert=None,
**timeout=30.0,**
use_proxy=False,
)
I also note that the category parameter in the input configuration screen has a typo (spelled as categroy), which prevents that value from being passed to the API call. The result is that the API call will run without a filter, returning events in all categories. This may impact the time taken by the call, which may put it over the 5.0 second default.
... View more
