Arista Networks Telemetry For Splunk: Why are events from Arista network device containing "ERROR: unable to connect to eAPI"?

[ben_leung]

Events coming from the Arista network device all contain the content "ERROR: unable to connect to eAPI".
I notice that the source and source types are scattered, so it seems the data is not generated correctly at the device before sending to Splunk.

Splunk internal logs from the device output :

ERROR ExecProcessor - message from "/usr/bin/eosfacts -r splunk.inventory -c /persist/sys/splunkforwarder/etc/arista.conf -index arista-splunk" No handlers could be found for logger "pyeapi.eapilib"

Working with someone that manages the Arista device, as I am unable to access the device itself to see what is configured.
They are suggesting that the credentials are setup wrong. I am not sure what user and password need to be input on the forwarder instance.
Any help would be appreciated!

[fredhsu]

For the Splunk extension you will need to enable eAPI on the switch and provide a user with access to eAPI. You can enable eAPI by the following configuration on the switch:

management api http-commands
  no shutdown

To configure a user you can use:

username <user> secret <pass>

Then specify this user and password in the splunk-forwarder configuration:

splunk-forwarder
    http-commands username <name>
    http-commands secret <passphrase>

Alternatively you can use UNIX sockets which eliminates the need for a user configured by specifying the following in the splunk-forwarder configuration:

splunk-forwarder
    http-commands protocol socket

[ben_leung]

Another follow question would be, does the credentials for the eAPI have to be the same on the instances of splunk that receive data from the switch (not just forwarder)?

[sakti]

The credentials set for eapi and forwarder has to be the same. Indexer credentials need not be the same as the one set on switch.