5

I am not 100% sure, but I believe that the splunk-sdk is using my proxy environment variables. Due to restrictions at work on our application proxy, I cannot access Splunk from Node.js. I would like to know how to prevent the splunk-sdk from using the application proxy.

var splunkjs = require('splunk-sdk');

var service = new splunkjs.Service({
    username: process.env.SPLUNK_USER,
    password: process.env.SPLUNK_PW,
    scheme: 'https',
    host: 'my.splunk.server',
    port: '8089',
    autologin: true
});

var search_term = 'somethingsomethingdarkside'
var fields = 'field1,field2,field3';
var searchquery = `search index=* sourcetype=* ${search_term} | fields ${fields} | fields - _raw`
var searchParams = {
    earliest_time: '-1h',
    latest_time: 'now',
    output_mode: 'json'
}


service.oneshotSearch(searchquery, searchParams, function(err, results) {
    if (err) {
        console.log(err)
    }
    else {
        console.log(results.results);
    }
});

This produces the following error:

root@c043a9e5e9f5:/app/app# node test_scripts/splunktest.js
{ response: { headers: {}, statusCode: 600 },
  status: 600,
  data: undefined,
  error: { [Error: tunneling socket could not be established, statusCode=503] 
  code: 'ECONNRESET' } 
}

If I unset my proxy environment variables, this script works perfectly.

mudda
  • 274
  • 3
  • 14

0 Answers0