Why is my simple Twitter REST API data input not g...

not_Ian · ‎08-30-2015

I followed these (two!) guides for making a Twitter input and have checked everything thrice:

http://blogs.splunk.com/2014/07/03/splunking-social-media-tracking-tweets/ and
http://discoveredintelligence.ca/stream-twitter-splunk-10-simple-steps/

Additionally, I downloaded a Twitter App onto Splunk that needed no configuration and it isn't receiving any data either. I've also been getting unknown error codes in splunkd.log:

08-30-2015 22:26:23.320 -0500 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/twitter2/bin/stream_tweets.py" </head>
08-30-2015 22:26:23.320 -0500 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/twitter2/bin/stream_tweets.py" <body>
08-30-2015 22:26:23.321 -0500 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/twitter2/bin/stream_tweets.py" <h2>HTTP ERROR: 401<h2>
08-30-2015 22:26:23.321 -0500 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/twitter2/bin/stream_tweets.py" <p>Problem accessing '/1.1/statuses/sample.json'. Reason:
08-30-2015 22:26:23.321 -0500 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/twitter2/bin/stream_tweets.py" </pre/>Unauthorized</pre>
08-30-2015 22:26:23.321 -0500 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/twitter2/bin/stream_tweets.py" </body>
08-30-2015 22:26:23.321 -0500 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/twitter2/bin/stream_tweets.py" </html>
08-30-2015 22:26:23.625 -0500 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/twitter2/bin/stream_tweets.py" Twitter reported status code 401: Unable to decode response, not vaild JSON.

I altered some of the HTML coding so it displayed properly. I also forwarded ports 8000 and 8089 which didn't affect anything. Would a DNS server affect this?

Please, help! Any advice will be appreciated!

Damien_Dallimor · ‎08-30-2015

Twitter may have changed their authentication logic since those blogs were written.

The current Authentication process is described here.

As this authentication scheme is Twitter specific , you would need to create a Custom Authentication Handler and apply this to the REST API Modular Input stanza you are setting up. The Twitter docs are very comprehensive for the logic require to implement this Authentication logic.

A related answer for custom authentication handlers is mentioned here.

Damien_Dallimor · ‎08-30-2015

You pasted an error dump from 1 App (Twitter App onto Splunk) , and then you've referred to a totally different App (REST API Modular Input) in the question tag and links to blogs.

Which App do you want to get working ?

Note : any errors for the REST API Modular Input are searchable with :

index=_internal ExecProcessor error rest.py

not_Ian · ‎08-30-2015

This is the error the REST API Modular Input is giving me and a screenshot of the info I have in my REST input.

08-31-2015 00:33:37.341 -0500 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/rest_ta/bin/rest.py" HTTP Request error: 401 Client Error: Authorization Required

Why is my simple Twitter REST API data input not generating any data?

Join Us for Splunk University and Get Your Bootcamp Game On!

.conf24 | Learning Tracks for Security, Observability, Platform, and Developers!

Announcing Scheduled Export GA for Dashboard Studio