Closed fkolacek closed 2 years ago
Forgot to mention that we were able to configure the app to talk to our Hive4 instance without any problems, it's just the Cortex part of the integration which doesn't work.
Hello @fkolacek, Thank you for submitting your issue and also providing a lot of details regarding your issue. Could you, from the SH, perform a curl request to your cortex instance just to check if the network is working well? If it’s working, I will make a review of your issue on my side with the same configuration.
thank you very much
Hello @LetMeR00t ,
thank you for your prompt reaction. Ive tried to access the Cortex instance directly from the Splunk SH using 2 approaches:
1) Contacting Cortex directly (there is an httpd reverse proxy running on the Cortex host used for SSL)
curl -H "Authorization: Bearer [REDACTED]" https://[CORTEX_HOST]/api/analyzer
2) Using SSH port forwarding to map Cortex default port locally (to eliminate possible problems with the httd reverse proxy)
curl -H "Authorization: Bearer [REDACTED]" http://127.0.0.1:9001/api/analyzer
Both of these approaches worked - I got valid API response from the Cortex API so the connectivity between Splunk SH and Cortex doesn't seem to be a problem.
Hello, I can reproduce the bug on my side. I'll work on it today. I confirm you that this is an issue within the application after the modification for cloud compatibility. I will let you know when the fix is ready.
I know what the issue is, and it seems to not be linked to the application. HTTPS is mandatory for both TheHive and Cortex now. Your tests are made using a Cortex URL in HTTP which is not accepted for Cloud environments (everything should be HTTP). Could you confirm that this is the issue you are facing ? Thank you
Hi again, After another check, yes, some things were missing in the application. A fix was provided on the github repository (v2.2.0) This version will be pushed to the Splunkbase soon. Thank you to tell me if the issue is now solved with this new version.
Hello again :)
I can confirm that the new version available on Splunkbase (v.2.2.0) fixed the issue and application now works well with both Cortex and Hive.
Thank you very much for such quick fix!
Request Type
Bug
Work Environment
Problem Description
We are trying to configure our Cortex instance in your app so Splunk can talk to it, howerver we are seeing following error when trying to List Cortex jobs form within Splunk:
Steps to Reproduce
To avoid any problems (SSL, firewall, etc) we've tried to forward the port from Cortex instance to the Splunk SH machine so Cortex actually listens on localhost (127.0.0.1) and default port (9001), so following command works:
Possible Solutions
-
Splunk Logs