topic Re: clicking on data inputs shows 500 internal server error in Security

clicking on data inputs shows 500 internal server error

cpt12tech — Fri, 15 Jul 2016 01:23:02 GMT

When clicking on the data inputs link in the splunk settings I see an error
500 Internal Server Error

In the web_service log I see this error
InternalServerError: [HTTP 500] Splunkd internal error; [{'text': "\n In handler 'http': Deployment Server is not available, because errors prevented its initialization. Please consult splunkd.log for details. You can try to reload Deployment Server after correcting these errors.", 'type': 'ERROR', 'code': None}]

I'm running a single indexing server, free license and not using a deployment server

I tried entering the command
disable deploy-server
and got the message
current license does not allow the requested action

I'm not using the serverclass.conf in the local folder

Re: clicking on data inputs shows 500 internal server error

sundareshr — Fri, 15 Jul 2016 01:36:19 GMT

What do you get when you type this query

index=_internal sourcetype=splunkd err*

Re: clicking on data inputs shows 500 internal server error

taiyed — Fri, 15 Jul 2016 02:02:10 GMT

I am also seeing this issue on Splunk 6.4.2 (Free License). I get the following error when looking in the _internal index for errors

"ERROR DeploymentServer - Deployment Server is not available, because errors prevented its initialization. Please consult splunkd.log for details. You can try to reload Deployment Server after correcting these errors."

Re: clicking on data inputs shows 500 internal server error

cpt12tech — Fri, 15 Jul 2016 02:15:49 GMT

Glad it's not just me. Thanks talyed.

Re: clicking on data inputs shows 500 internal server error

cpt12tech — Fri, 15 Jul 2016 02:16:06 GMT

07-14-2016 19:51:12.106 -0600 ERROR DeploymentServer - Deployment Server is not available, because errors prevented its initialization. Please consult splunkd.log for details. You can try to reload Deployment Server after correcting these errors.

Re: clicking on data inputs shows 500 internal server error

sundareshr — Fri, 15 Jul 2016 02:50:06 GMT

If you not using the DS, delete etc/deployment-apps directory and remove the serverclass.conf from local folder (do not delete from default folders)

Re: clicking on data inputs shows 500 internal server error

somesoni2 — Fri, 15 Jul 2016 03:29:59 GMT

Check if there are any configuration errors in your instance. Run this. If any error found fix them and restart Splunk.

splunk btool check --debug

Re: clicking on data inputs shows 500 internal server error

inventsekar — Fri, 15 Jul 2016 06:03:20 GMT

maybe check this one...
https://answers.splunk.com/answers/356955/why-am-i-getting-500-internal-server-error-when-i.html

For those of you that are interested in the resolution. I (stupidly) disabled the splunk_httpinput app on the indexer. Once I re-enabled it, trying to add data worked just fine.

Re: clicking on data inputs shows 500 internal server error

andersson — Fri, 15 Jul 2016 16:07:51 GMT

I have the exact same problem. I tried deleting the etc/deployment-apps directory but it made no difference.

Re: clicking on data inputs shows 500 internal server error

cpt12tech — Fri, 15 Jul 2016 19:39:27 GMT

That did not work for me. splunk_httpinput is enabled for me. I disabled, then enabled and did not help. It did stop the web server, which I started back up by typing in
./splunk enable webserver

Re: clicking on data inputs shows 500 internal server error

cpt12tech — Fri, 15 Jul 2016 19:39:42 GMT

Ran the --debug, no errors found

Re: clicking on data inputs shows 500 internal server error

cpt12tech — Fri, 15 Jul 2016 19:44:42 GMT

correction
ran the splunk start --debug
and no errors found
when I ran btool check --debug
I do see one error
No spec file for: C:\Program Files\Splunk\etc\system\local\migration.conf

Re: clicking on data inputs shows 500 internal server error

cpt12tech — Fri, 15 Jul 2016 22:03:57 GMT

Followed the instructions, deleted the folder and the blank serverclass.conf file. Restarted splunk, went to data inputs, no change in the problem. Verified the error showed up in the splunk errors index.

Re: clicking on data inputs shows 500 internal server error

ppablo — Mon, 15 Aug 2016 18:32:48 GMT

Hi @cpt12tech

Thanks for bringing attention to this issue on Splunk Answers. A bug was filed the last week of July and is tracked as a known issue under SPL-124923: Selecting Data Inputs under Settings results in a "500 Internal Server Error" in Splunk Enterprise 6.4.2 on a Forwarder or Free license.
http://docs.splunk.com/Documentation/Splunk/6.4.2/ReleaseNotes/KnownIssues#Splunk_Web_and_Home_interface_issues

The fix for this bug is expected in the upcoming 6.4.3 release. The current workaround is to downgrade to 6.4.1 for instances with a Forwarder or Free license.

Re: clicking on data inputs shows 500 internal server error

cpt12tech — Wed, 24 Aug 2016 17:19:05 GMT

Upgrading to 6.4.3 resolved this for me! I can access the data inputs using the Web GUI.

Re: clicking on data inputs shows 500 internal server error

ppablo — Mon, 29 Aug 2016 21:23:59 GMT

Awesome, thanks @cp12tech for updating the thread and confirming the upgrade helped resolve the issue 🙂

Cheers
Patrick