Splunk Dev

splunk-sdk-python-1.2.2 -> stop working after upgrading to Splunk 6.0 from Splunk 4.3

lpolo
Motivator

After upgrading to Splunk 6.X all our python scripts that use the latest version of splunk sdk “splunk-sdk-python-1.2.2” stop working. The error we constantly get is the following:

ssl.SSLError: [Errno 1] _ssl.c:492: error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol

Has anyone faced this issue?
How did you solve it?

These are the connection parameters we used.

HOST = "myhost.com"
PORT = 8089
USERNAME = "myaccountid"
PASSWORD = "mypassword"
OWNER = "myaccountid"
APP = "search"

# Create a Service instance and log in
service = client.connect(
    host=HOST,
    port=PORT,
    username=USERNAME,
    password=PASSWORD,
    app=APP,
    owner=OWNER,
    )

After a couple of tests and reading the splunk sdk API. I realized that https scheme is the default in splunklib.client.connect. However, after the upgrade it looks like the splunk admin disabled the support of https. So the issue was solved as follow:

HOST = "myhost.com"
PORT = 8089
USERNAME = "myaccountid"
PASSWORD = "mypassword"
OWNER = "myaccountid"
SCHEME = "http"
APP = "search"

# Create a Service instance and log in
service = client.connect(
    host=HOST,
    port=PORT,
    username=USERNAME,
    password=PASSWORD,
    app=APP,
    owner=OWNER,
    scheme=SCHEME
    )
0 Karma

sloshburch
Splunk Employee
Splunk Employee

I've seen that before when non SSL forwarders try to connect to an SSL indexer (or vice versa - I forget which). The point is, I got that error message while working with basic splunk features, not even with the python SDK.

Anyway - I bet if you make sure everyone's talking the same thing (SSL or http) then you'll find the issue is resolved. Maybe the latest splunk defaults to SSL and the python code you have is still talking http? I'd also remove any sslPassword fields to force splunk to regen them...just for good measure.

0 Karma

i2sheri
Communicator

also when requireClientCert=true is enabled the service = client.connect() fails
any information on this ?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...