I am trying to run the website monitoring app through our proxy and get a connection failed. If I run it without the proxy settings it works just fine. I looked in the web_availability_modular_input.log and found the following:
Traceback (most recent call last):
File "C:\Program Files\Splunk\etc\apps\website_monitoring\bin\web_ping.py", line 257, in ping
response, content = http.request( url.geturl(), 'GET')
File "C:\Program Files\Splunk\Python-2.7\Lib\site-packages\httplib2_init.py", line 1421, in request
(response, content) = self._request(conn, authority, uri, request_uri, method, body, headers, redirections, cachekey)
File "C:\Program Files\Splunk\Python-2.7\Lib\site-packages\httplib2__init.py", line 1171, in _request
(response, content) = self._conn_request(conn, request_uri, method, body, headers)
File "C:\Program Files\Splunk\Python-2.7\Lib\site-packages\httplib2__init.py", line 1122, in _conn_request
conn.connect()
File "C:\Program Files\Splunk\Python-2.7\Lib\site-packages\httplib2__init.py", line 786, in connect
self.sock.connect(sa)
File "C:\Program Files\Splunk\Python-2.7\Lib\site-packages\httplib2\socks.py", line 424, in connect
self._negotiatehttp(destpair[0], destpair[1])
File "C:\Program Files\Splunk\Python-2.7\Lib\site-packages\httplib2\socks.py", line 390, in __negotiatehttp
raise HTTPError((statuscode, statusline[2]))
HTTPError: (403, 'Forbidden')
Our proxy will allow both authenticated and unauthenticated traffic but it doesn't seem to matter as neither option will work for me. I am running through port 8080 and giving it our fully qualified server name. It is also an HTTP type of Proxy.
My inputs.conf:
[web_ping://CNN]
interval = 5m
title = CNN
url = http://www.cnn.com
After looking into this more I found that the proxy was getting the request correctly and sending back a 403 forbidden error back to splunk. This was/is a problem with our implementation of the proxy.
After looking into this more I found that the proxy was getting the request correctly and sending back a 403 forbidden error back to splunk. This was/is a problem with our implementation of the proxy.
I just tested this and it worked for me (same the website using an HTTP proxy). Perhaps it is an issue with a particular version of Splunk. What version of Splunk are you using?
I am using Splunk Enterprises 6.1.1 and also tried it on 6.1.4