DataGateway - Connection to Splunk error

[SergioSampietro]

Hi all,

I'm trying to connect to Splunk using DataGateway v6.10 but I'm facing the following error:

[HTTP Output Failure] Could not fetch URL {:url=>"https://10.xxx.xxx.xxx:30333/services/collector/event", :method=>:post, :body=>"{\"event\":\"{\\\"EventType\\\":1,\\\"EventData\\\":{\\\"ProcessName\\\":\\\"Scarico File da Poste\\\",\\\"StageName\\\":\\\"Start\\\",\\\"ResourceName\\\":\\\"machinename.tes.local_debug\\\",\\\"StageId\\\":\\\"0a89fa70-860c-4c59-a292-54dc04746b6d\\\",\\\"Attributes\\\":\\\"\\\",\\\"ResultType\\\":\\\"unknown\\\",\\\"PageName\\\":\\\"Main Page\\\",\\\"ObjectName\\\":\\\"\\\",\\\"Result\\\":\\\"\\\",\\\"StartDate\\\":\\\"2022-02-01T09:21:02.263691+01:00\\\",\\\"ActionName\\\":\\\"\\\",\\\"SessionNumber\\\":4815,\\\"ResourceId\\\":\\\"334342f7-e223-45aa-bbba-268b244d4be0\\\",\\\"StageType\\\":\\\"Start\\\"}}\"}", :headers=>{"Authorization"=>"Splunk f6fe286b-56a8-4b29-9812-77e7a99570e0", "Content-Type"=>"application/json"}, :message=>"Host name '10.xxx.xxx.xxx' does not match the certificate subject provided by the peer

Below my Splunk configuration:

Splunk certificate has been installed on BP Application Server.

Any ideas?

Thank you

[ewilson]

Hi @SergioSampietro,

Are you leveraging one of the existing BP-Splunk integrations available via the DX, or is this something you’re building from scratch?

The existing integrations include user guides that may shed some light on your issue. The first integration linked below is based on Data Gateways:

https://digitalexchange.blueprism.com/dx/entry/3439/solution/splunk-for-blue-prism

The second integration is actually based on direct database queries and bypasses Data Gateways.

​https://digitalexchange.blueprism.com/dx/entry/3439/solution/blue-prism-analytics-for-splunk

Both of these solutions are available in Splunkbase too.

Cheers,
Eric

[SergioSampietro]

Hi Eric,

thanks for youre reply, I'm not sure but I think that I'm not in both situations that you described.

I have installed and configurated DataGateway for Splunk following the User Guide (see attached file), and it seems that in order to connect and send data to Splunk I need only:

- Splunk URL
- Splunk Token


so you are saying that to finalize the installation I need to install connectors also on Splunk side?

Thank you
Sergio

[ewilson]

Hi @SergioSampietro,

Apologies. I didn't mean to add confusion to this. No, you do not have to use the connectors on the DX to be able to tie Data Gateways to Splunk. Those assets are simply canned solutions that were built that include pre-developed Splunk dashboards as well as documentation around the steps to integrate.

The reason I pointed them out is that I wasn't sure if there might be some additional troubleshooting information that might help you in diagnosing your issue. I know when the canned DG-to-Splunk integration was built, the standard Data Gateways documentation had some holes in it, so it was a bit of a trial for the DX team to get working.

Cheers,
Eric​

[SergioSampietro]

Hi Eric,

so what can I do now? Waiting for more exhaustive documentation?

Thanks
Sergio

[ewilson]

@SergioSampietro,

From the error message you've shown it seems there may be a certificate issue. The error message is pretty clear that "Host name '10.xxx.xxx.xxx' does not match the certificate subject provided by the peer". Are you using a self-signed certificate or an actual certificate. What hostnames appear in the certificate? Is it just the actual DNS name of the server (ex. server01.mydomain.com) or is the IP address also included in the certificate?

Cheers,
Eric