search

splunk / battlecat-poll

Real-time poll demo via Splunk HTTP event collector
Other
6 stars 2 forks source link

Issue receiving HTTP Events from the Poll #1

Open ryanwoconnor opened 8 years ago

ryanwoconnor commented 8 years ago

I am running an Ubuntu server and have followed the documentation. When I open the poll and click some answers to a question no events are showing up in Splunk. I have verified the http event input is working by using

curl -k https://localhost:8088/services/collector/event -H "Authorization: Splunk " -d '{"event": "hello world"}'

glennblock commented 8 years ago

Hi @ryanwoconnor have you enabled CORS? What version of Splunk are you using?

ryanwoconnor commented 8 years ago

6.3.2

I have added the following to server.conf and restarted

[httpServer] crossOriginSharingPolicy = *

glennblock commented 8 years ago

Are you using SSL?

Can you try opening the Chrome Debugger Console and see if you are getting errors like 401 Unauthorized?

ryanwoconnor commented 8 years ago

If I open up the console and click on a button I get the following:

OPTIONS URL net::ERR_CONNECTION_RESET Uncaught (in promise) undefined

ryanwoconnor commented 8 years ago

I actually just manually edited poll.js to change ssl:!1 to ssl:1 and am now getting

OPTIONS URL net::ERR_INSECURE_RESPONSE Uncaught (in promise) undefined

When I built this I did have the following in the build.sh file:

 # `true` if SSL is enabled for the Splunk HTTP input
 export PP_SPLUNK_SSL=true
glennblock commented 8 years ago

Try without SSL enabled (make sure to disable on the HEC side). I am guessing it is because you are using the default self-signed Splunk cert which is not valid. When using CORS and SSL you MUST have a valid cert.

ryanwoconnor commented 8 years ago

Got it, thank you. I don't know if that SSL issue was supposed to be related to the config file or not but it looks like the main issue for me was manually altering the ssl setting in poll.js. Thank you!

glennblock commented 8 years ago

Ah so maybe you did not have SSL? enabled on the HEC side in which case trying to send SSL would not work On Mon, May 23, 2016 at 7:05 PM ryanwoconnor notifications@github.com wrote:

Got it, thank you. I don't know if that SSL issue was supposed to be related to the config file or not but it looks like the main issue for me was manually altering the ssl setting in poll.js. Thank you!

— You are receiving this because you commented.

Reply to this email directly or view it on GitHub https://github.com/splunk/battlecat-poll/issues/1#issuecomment-221147476

ryanwoconnor commented 8 years ago

Ah you're correct sorry about the mix-up.

To start out with I had SSL enabled on HEC and also in the polling app.

The problem was the certificate was self-signed.

I was able to manually edit poll.js to be non-ssl without recompiling and also switch HEC to not use SSL and my issue is resolved.

As a side note I also was able to switch the default port using poll.js and also change the port on the HEC.

ryanwoconnor commented 8 years ago

Also thank you for this cool app =D