Twitted input.py HTTP Error 401(Unauthorized)

[pwong591]

Hello Splunk community! I'm new to Splunk and I would like to be able to access and index data from my own Twitter account. It looks like the perfect example is the Twitted>input.py program. After taking a look at the README from the twitted folder, I successfully added the app to the Splunk web interface.

When I run:

python input.py

I'm prompted my username and password. I entered my personal Twitter account credentials but I was hit with

Initializing Splunk ..
Listening (and sending data to localhost:9001)..
Error: There was an error logging in to Twitter:
HTTP Error 401 (Unauthorized)

I came across this forum post:

http://answers.splunk.com/answers/74633/data-not-going-to-splunk

but after checking my .splunkrc file and making sure my original input.py file was unedited, everything seems like it should work.

Just for some additional info, I'm running Splunk enterprise 6.0, and using the python sdk 1.1. While I run this, I'm logged onto the Splunk web interface.

If anyone can offer a few words of advice, I would greatly appreciate it!

[Damien_Dallimor]

This is easy to do with the REST API Modular Input.

Download and untar to SPLUNK_HOME/etc/apps : http://apps.splunk.com/app/1546/

Then setup a stanza like the example below (for searching for tweets).

Replace the oauth values with your own.

Change the twitter query in the url_args to the tweets you want to search for.

You can also add additional stanzas for other Twitter REST API endpoints.

[rest://My Tweets]
auth_type = oauth1
endpoint = https://api.twitter.com/1.1/search/tweets.json
http_method = GET
index = main
index_error_response_codes = 1
oauth1_access_token = XXXXXXXXXXXXX
oauth1_access_token_secret = XXXXXXXXXXXXX
oauth1_client_key = XXXXXXXXXXXXX
oauth1_client_secret = XXXXXXXXXXXXX
polling_interval = 30
response_handler = TwitterEventHandler
response_type = json
sourcetype = rest_twitter
streaming_request = 0
url_args = q=#splunk
disabled = 1

[Damien_Dallimor]

Probably because BASIC Auth is no longer supported for the streaming API : https://dev.twitter.com/docs/streaming-apis/streams/public

[pwong591]

Thank you Damien for helping me find a solution to the problem. I'll work with the REST API from now on.

Although, I still wonder what was wrong with the sample program/set up.