Proxy information causing issues?

[darrenfuller]

Added proxy info to the mmdb_utils.py file.

proxies = {
    'https' : 'https://192.168.25.5:8080'
}

getting error "check_hostname requires server_hostname" when i run the | maxmindupdate command in splunk .

[VatsalJagani]

@mahirchavda - Something to look at - https://stackoverflow.com/questions/66642705/why-requests-raise-this-exception-check-hostname-requires-server-hostname

@darrenfuller - Meanwhile, can you please tell me:

• Your Splunk version?
• MaxMind DB Auto Update App version?

[darrenfuller]

Splunk 9.05 Auto Update: 3.1.0

[VatsalJagani]

@darrenfuller - Can you please try:

proxies = {
    'http' : 'https://192.168.25.5:8080'
    'https' : 'https://192.168.25.5:8080'
}

And if that does not work, give this a try:

proxies = {
    'https' : '192.168.25.5:8080'
}

urllib3 changed schema, not sure, but I'm sure 1st solution here have worked for us in the past.

[darrenfuller]

The latter seemed to work (in that we now get a "Max Mind Database updated successfully" message after running the command ..

But when i look at $SPLUNK_HOME/share.. the dbip-city-lite.mmdb file still has a last updated date of May 15, 2023... and the most recent maxmind file on their web site is from 2 days ago... so it doesn't feel like it's working (also the command returns immediately with zero delay).

We can see activity cross the proxy server from the SH however.

We thought it could be because we are in a non-standard Splunk location ( /opt/splunk/splunk )... and the mmdb_utlils.py has

current_location = '/opt/splunk/share'

so i tried changing that to '/opt/splunk/splunk/share' ... but that didn't make a difference that we can see.

thoughts on how to troubleshoot?

[darrenfuller]

I stand corrected. it's updating in $SPLUNK_HOME/etc/apps/lookups... and it is updating successfully.

thanks for your help!!!!