topic Re: Why am I getting a 404 error when I try to set up Cisco Security Suite 3.1.1 in Splunk Enterprise 6.4.1? in All Apps and Add-ons

Why am I getting a 404 error when I try to set up Cisco Security Suite 3.1.1 in Splunk Enterprise 6.4.1?

madura_eleperum — Wed, 08 Jun 2016 01:09:20 GMT

I installed Cisco Security Suite (3.1.1) on Splunk Enterprise 6.4.1, and when I try to set it up by going to app management > set up (under Actions of Cisco Security Suite), I get a 404 error:

I have installed all the required add-ons and restarted Splunk and checked all other aspects of it. However, I did not set up the Firesight, IPS, or ISE add-ons as I do not have those appliances in my infrastructure and I just wanted to run through the setup process as a trial before I do it in production.

Any idea why this is?

Re: Why am I getting a 404 error when I try to set up Cisco Security Suite 3.1.1 in Splunk Enterprise 6.4.1?

klaxdal — Wed, 13 Jul 2016 11:07:41 GMT

Change the following line in /opt/splunk/etc/system/local/web.conf

"#default timeout, in seconds, when communicating with splunkd"
splunkdConnectionTimeout = 1400

Re: Why am I getting a 404 error when I try to set up Cisco Security Suite 3.1.1 in Splunk Enterprise 6.4.1?

madura_eleperum — Wed, 21 Sep 2016 00:49:02 GMT

I tried this, but still the same 😞

Re: Why am I getting a 404 error when I try to set up Cisco Security Suite 3.1.1 in Splunk Enterprise 6.4.1?

MuS — Wed, 21 Sep 2016 01:01:31 GMT

Hi madura.eleperuma,

there is a new version 3.1.2 at https://splunkbase.splunk.com/app/525/ and it works just fine on Splunk 6.4.2.

Hope this helps ...

cheers, MuS

Re: Why am I getting a 404 error when I try to set up Cisco Security Suite 3.1.1 in Splunk Enterprise 6.4.1?

madura_eleperum — Wed, 21 Sep 2016 01:33:56 GMT

I upgraded to 3.1.2 on Splunk Enterprise 6.4.1 and still it's the same. I don't think upgrading Splunk to just one minor version would result in a big difference.

Anyone had success with setting up the latest version of Cisco Security Suite on Splunk 6.4.x?

Re: Why am I getting a 404 error when I try to set up Cisco Security Suite 3.1.1 in Splunk Enterprise 6.4.1?

MuS — Wed, 21 Sep 2016 01:48:18 GMT

What happens if you adapt this link to your server name

http://YourSplunkServerNameHere:Port/en-US/manager/Splunk_CiscoSecuritySuite/apps/local/Splunk_CiscoSecuritySuite/setup?action=edit

and try it? Looking at your posted error you were accessing /manager/search/apps/local?search=cisco&count=25.... the rest is missing but this would indicate a search within the Splunk Apps UI. Even when doing this here http://MySplunkServerNameHere:8000/en-US/manager/search/apps/local?search=cisco&count=25 and clicking on Set up works perfect.

Check your splunkd.log and the web_access.log what is happening if you try to set ups the app.

cheers, MuS

Re: Why am I getting a 404 error when I try to set up Cisco Security Suite 3.1.1 in Splunk Enterprise 6.4.1?

nhdpotter — Tue, 28 Feb 2017 23:19:38 GMT

I received this error on a 6.5.2 Splunk Server where the default management port had been changed. After setting the management port back to 8089 the app worked as expected. I suspect somewhere in the app there is something hard coded that should not be which causes this issue.

Re: Why am I getting a 404 error when I try to set up Cisco Security Suite 3.1.1 in Splunk Enterprise 6.4.1?

jimmoriarty — Tue, 29 Sep 2020 13:13:27 GMT

The setup assumes that you have very little data in your Splunk environment - and does a 'open' search against your default indexes for any of the sourcetypes it's looking for - in a large environment, these searches will take longer than the timeout (hence the suggestions to increase the time out in the answers above).

If you are in a large environment, I would highly recommend directly editing Splunk_CiscoSecuritySuite/bin/css_setup_handler.py to make the searches a little more restrictive (e.g. add in an index clause to help setup find what its looking for, or simply pull all the searches and set the flags directly (e.g. alter the lines looking like info['asa_count'] = 0 to = 1 instead where a feature should be installed).

Also note that the app does not appear to be SHC compliant - so the setup needs to be run on each node.

Re: Why am I getting a 404 error when I try to set up Cisco Security Suite 3.1.1 in Splunk Enterprise 6.4.1?

meleperuma — Wed, 10 May 2017 23:44:34 GMT

Hi nhdpotter,

This was the case with me as well. As soon as I changed the management port back to 8089 it worked 🙂

Thanks for the reply.

Note: I'm the same guy who posted the question. But for some internal unknown account/identity screw up I lost access to my account and had to create this new one; lost all history from answers.splunk.com.

Re: Why am I getting a 404 error when I try to set up Cisco Security Suite 3.1.1 in Splunk Enterprise 6.4.1?

xsstest — Thu, 11 May 2017 02:27:13 GMT

webui——settings——show all settings

Re: Why am I getting a 404 error when I try to set up Cisco Security Suite 3.1.1 in Splunk Enterprise 6.4.1?

dfqobvbkmnpi — Thu, 11 May 2017 23:04:35 GMT

you're the only person that gave this explanation. everyone else just suggested increasing the splunkdConnectionTimeout in web.conf.

i commented out the searches for the sourcetypes that i don't care about and added the relevant index to the sourcetype(s) i do care about and that worked like a charm.

thank you!

Re: Why am I getting a 404 error when I try to set up Cisco Security Suite 3.1.1 in Splunk Enterprise 6.4.1?

Amulya888 — Mon, 22 Oct 2018 15:14:00 GMT

how to change the management port to 8089?...Please help,
As I received the same error.

Re: Why am I getting a 404 error when I try to set up Cisco Security Suite 3.1.1 in Splunk Enterprise 6.4.1?

nhdpotter — Mon, 22 Oct 2018 15:18:22 GMT

duckduckgo.com/?q=change+splunk+management+port

https://answers.splunk.com/answers/44270/change-splunk-web-server-from-the-default-setting-of-port-8000-to-port-8081.html

http://docs.splunk.com/Documentation/Splunk/latest/Admin/Changedefaultvalues#Change_network_ports

Re: Why am I getting a 404 error when I try to set up Cisco Security Suite 3.1.1 in Splunk Enterprise 6.4.1?

Rob2520 — Tue, 13 Nov 2018 21:25:25 GMT

splunkdConnectionTimeout = 1200 worked for me.