Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

specify data must exist on actual Splunk server #728

Open
wants to merge 2 commits into
base: master
Choose a base branch
from

Conversation

fryguy04
Copy link
Contributor

@fryguy04 fryguy04 commented Apr 8, 2022

I got tripped up and digging through code why it was failing. I was running this on my laptop and pointing it to an EC2 Splunk server. Figured out I believe these commands are supposed to be ran on the actual Splunk server .. so I ssh'd in and it worked.

This is my first time so if this is incorrect please don't merge, but hopefully helping someone else who comes behind and may try and populated data into a remote Splunk server (which didn't work for me)

I got tripped up and digging through code why it was failing. I was running this on my laptop and pointing it to an EC2 Splunk server. Figured out I believe these commands are supposed to be ran on the actual Splunk server .. so I ssh'd in and it worked.

This is my first time so if this is incorrect please don't merge, but hopefully helping someone else who comes behind and may try and populated data into a remote Splunk server (which didn't work for me)
@josehelps
Copy link
Contributor

It should work across remote servers, it just connects via 8089, maybe FW did not have that port publicly open @fryguy04?

@josehelps josehelps self-requested a review April 11, 2022 01:15
@josehelps josehelps self-assigned this Apr 11, 2022
@josehelps josehelps added the WIP label Apr 11, 2022
@fryguy04
Copy link
Contributor Author

fryguy04 commented Apr 11, 2022

Yes, verified (via nmap) port 8089 is open. Just tried it again and getting this error from my Laptop (remote machine). Note when i do this from the Splunk server (ssh'd in) it works. Any ideas whats going on?

splunklib.binding.HTTPError: HTTP 400 Bad Request -- unable to open file

I verified file is readable/accessible via Python (I read out the first line). I chmod it 777 just in case, no luck.

Screen Shot 2022-04-11 at 10 20 43

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants