REST API issues

Applicability

Description

This article helps with common issues  when configuring REST API using the “Splunk REST API"

Investigation

1. Certificate error:

   httplib2.SSLHandshakeError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:741)

   The error comes from the imported module httplib2, and it is displayed when the self-signed certificates cannot be verified by the certificate authority,
   If using Splunk default certs the message may appear.  To fix it (or make the module ignore it)  use “disable_ssl_certificate_validation=True”, go to the 11^th line of the Python script, and add “disable_ssl_certificate_validation=True”:
   
   

   import urllib
   import httplib2
   import time
   import re
   from time import localtime,strftime
   from xml.dom import minidom
   import json
   baseurl = 'https://hostname:8089'
   username = 'username'
   password = 'password'
   myhttp = httplib2.Http(disable_ssl_certificate_validation=True)

• “Unknown protocol” error:

  httplib2.SSLHandshakeError: [SSL: UNKNOWN_PROTOCOL] unknown protocol (_ssl.c:741)

  If getting this error, confirm the right port in the baseurl variable is used. For example, using 8000 in the script, instead of 8089:

  baseurl = 'https://hostname.com:8000

• “Connection reset by peer” error:
  Check a secure connection is used, using HTTPS and not HTTP in the baseurl variable:

  baseurl = 'http://hostname.com:8089'

• “Out of range” error:

  IndexError: list index out of range

  Even though the issue seems related to the search,  confirm if the username and the password are correct, lines 9 and 10 will take the Splunk username and the password and put them into the username and the password variables.

  username = 'admin'
  password = 'password1234'

  
  If this they are correct, confirm there are no typos in the directories, for example “/services/auth/login” or “/services/search/jobs”
  Check if the hostname is correct or pointing to the right instance.

• Fatal error:
  Search result:

   Error in 'search' command: Unable to parse the search: Comparator '=' has an invalid term on the left hand side: index=sourcetype.
   
  

  
  
  This error refers to an invalid search. Test the search in the first line of the Step 2 of the script:
   

Resolution

• #Step 2: Create a search job

  searchquery = 'index=  sourcetype=internal | stats count by log_level'

  
  Notice what is after “Unable to parse the search:” is the error the graphical interface would display:

  disable_ssl_certificate_validation=True

• No results:
  If no error appears consider checking if the graphical interface receives a result,and if the search and time range are correct.
  It is possible to use the earliest and latest in the basic search to override the time range picker, for example:
  

  index=_internal earliest=-15m latest=now | stats count by log_level

• “Connection timed out” error:
  This error is related to networking issues, confirm the connection between instances: if the source IP address can connect to the destination IP address, and if the DNS can translate the hostname. Confirm the proxy/firewall allows the connection.
  

  socket.error: [Errno 110] Connection timed out

• “404” error:
  Check if using the right hostname.
• “ImportError: No module named httplib2: error:
  To avoid this error, use Splunk binary to run Python:

  ~]$which python
  /usr/bin/python
  ~]$source /opt/splunk/bin/setSplunkEnv
  Tab-completion of "splunk " is available.
  ~]$which python
  /opt/splunk/bin/python

  
   

Related Links

splunk-rest-api-is-easy-to-use.html