Security

Twitted input.py HTTP Error 401(Unauthorized)

pwong591
Engager

Hello Splunk community! I'm new to Splunk and I would like to be able to access and index data from my own Twitter account. It looks like the perfect example is the Twitted>input.py program. After taking a look at the README from the twitted folder, I successfully added the app to the Splunk web interface.

When I run:

python input.py

I'm prompted my username and password. I entered my personal Twitter account credentials but I was hit with

Initializing Splunk ..
Listening (and sending data to localhost:9001)..
Error: There was an error logging in to Twitter:
HTTP Error 401 (Unauthorized)

I came across this forum post:

http://answers.splunk.com/answers/74633/data-not-going-to-splunk

but after checking my .splunkrc file and making sure my original input.py file was unedited, everything seems like it should work.

Just for some additional info, I'm running Splunk enterprise 6.0, and using the python sdk 1.1. While I run this, I'm logged onto the Splunk web interface.

If anyone can offer a few words of advice, I would greatly appreciate it!

0 Karma

Damien_Dallimor
Ultra Champion

This is easy to do with the REST API Modular Input.

Download and untar to SPLUNK_HOME/etc/apps : http://apps.splunk.com/app/1546/

Then setup a stanza like the example below (for searching for tweets).

Replace the oauth values with your own.

Change the twitter query in the url_args to the tweets you want to search for.

You can also add additional stanzas for other Twitter REST API endpoints.

[rest://My Tweets]
auth_type = oauth1
endpoint = https://api.twitter.com/1.1/search/tweets.json
http_method = GET
index = main
index_error_response_codes = 1
oauth1_access_token = XXXXXXXXXXXXX
oauth1_access_token_secret = XXXXXXXXXXXXX
oauth1_client_key = XXXXXXXXXXXXX
oauth1_client_secret = XXXXXXXXXXXXX
polling_interval = 30
response_handler = TwitterEventHandler
response_type = json
sourcetype = rest_twitter
streaming_request = 0
url_args = q=#splunk
disabled = 1

Damien_Dallimor
Ultra Champion

Probably because BASIC Auth is no longer supported for the streaming API : https://dev.twitter.com/docs/streaming-apis/streams/public

0 Karma

pwong591
Engager

Thank you Damien for helping me find a solution to the problem. I'll work with the REST API from now on.

Although, I still wonder what was wrong with the sample program/set up.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...