topic Re: Getting a "500 Internal Server Error" when navigating to Settings > Data Inputs (Licensed Version 7.3.1). in Security

Getting a "500 Internal Server Error" when navigating to Settings > Data Inputs (Licensed Version 7.3.1).

socrates4rufio — Thu, 28 May 2020 16:51:44 GMT

Version 7.3.1 - Splunk Enterprise - Licensed

I receive a "500 Internal Server Error" when I try to navigate to Settings > Data Inputs. I've searched posted Answers with version 6.3. "splunk_httpinput app" is enabled; the other was to update to version 6.4.3. Neither provide resolution to the problem.

Didn't have any luck finding alternate methods to modify data inputs.

Thanks for the help.

Re: Getting a "500 Internal Server Error" when navigating to Settings > Data Inputs (Licensed Version 7.3.1).

PavelP — Thu, 28 May 2020 17:42:07 GMT

Hello @socrates4rufio

do you see any errors in $SPLUNK_HOME/var/log/splunk/splunkd.log ?

Re: Getting a "500 Internal Server Error" when navigating to Settings > Data Inputs (Licensed Version 7.3.1).

socrates4rufio — Thu, 28 May 2020 19:57:58 GMT

Hello @PaveIP

I did some further investigation:

When I use Chrome (64-bit) Ver 73.0... I receive a SSL3 alert - certificate unknown

When I use IE or Firefox; I still get the 500 Internal Error, but I don't get an error in splunkd.log

-- Thanks for the quick response

Re: Getting a "500 Internal Server Error" when navigating to Settings > Data Inputs (Licensed Version 7.3.1).

PavelP — Wed, 30 Sep 2020 05:32:57 GMT

@socrates4rufio

is splunk running on windows or linux?
what happens if you click ignore/continue cert warning in Chrome? The same 500 Internal error?
can you post a full browser warning you get?
check also splunkd_access.log and splunkd_ui_access.log for 500 error and post the matching lines here
try to find any lines in splunkd.log matching the time when you navigating to Settings > Data Input
if not logged as admin - try to relogin as admin and test again. Do you get the same 500 error?

Re: Getting a "500 Internal Server Error" when navigating to Settings > Data Inputs (Licensed Version 7.3.1).

socrates4rufio — Wed, 30 Sep 2020 05:36:16 GMT

Good Afternoon @PaveIP

I'm running Splunk Enterprise on a virtual Windows Server 2016.

The system is running in a standalone environment that's not connected to the internet - I'm not able to post a full browser image.

I checked the splunkd_access.log and the splunkd_ui_access.log:

"GET /en-US/splunkd/raw/servicesNS/nobody/splunk_instrumentation/instrumentation_controller/instrumentation_eligibility?optInVersion=3&=1591038782439 HTTP/1.1" 200 289 "-""Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.85 Safari/537.36" - <...> 1529ms

"GET /en-US/manager/launcher/datainputstats HTTP/1.1" 500 57504 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.85 Safari/537.36" - <...> 319ms

I've tried logging in as Admin and another Administrator account; as well as multiple web browsers. I enabled all TLS/SSL versions. Everything yields the same result.