topic Re: SolarWinds app modular error. in All Apps and Add-ons

SolarWinds app modular error.

NHLaurent — Wed, 30 Sep 2020 04:49:20 GMT

Hi All,

I've installed the latest SolarWinds Add-on for Splunk (https://splunkbase.splunk.com/app/3584/#/details)

After installing and restart I'm getting the following error;
Unable to initialize modular input "solwarwinds_query" defined in the app "Splunk_TA_SolarWinds": Introspecting scheme=solwarwinds_query: script running failed (exited with code 1)..

When opening the app it just sits there spinning its logo.

Any ideas

Splunk Ent V8 on WIndows.

Re: SolarWinds app modular error.

PG — Fri, 07 Aug 2020 17:23:44 GMT

Having the same issue did you ever get this fixed?

Re: SolarWinds app modular error.

hansuleberg — Tue, 17 Nov 2020 16:20:51 GMT

Same issue here as well.

Unable to initialize modular input "solwarwinds_query" defined in the app "Splunk_TA_SolarWinds": Introspecting scheme=solwarwinds_query: script running failed (exited with code 1)..

Splunk Enterprise 8.1 on Linux.

Re: SolarWinds app modular error.

PG — Tue, 17 Nov 2020 16:40:03 GMT

I notified Splunk via a ticket and they told me I needed to contact Solarwinds. I then opened a ticket with Solarwinds and they stated I need to go back to Splunk. So I opened another ticket and they told me

"something that I am noticing is that the Add-On is only compatible to Splunk Cloud environment and this ticket has been open as an On-Prem instance. Splunk Enterprise and Splunk Cloud differ significantly in software composition, if you are installing in Splunk Enterprise(On-Prem) then the installation will definitely not work and that's the reason of this issue."

We are on Splunk 8.1 on Linux as well. We use AWS Linux servers. We had the add on working before with no issues. Not sure if this helps any.

Re: SolarWinds app modular error.

hansuleberg — Tue, 17 Nov 2020 16:51:00 GMT

Thank you.

Yes, what is strange it is listed as supported on Splunk platform 8.1

https://splunkbase.splunk.com/app/3584/#/details

COMPATIBILITY

Products: Splunk Enterprise, Splunk Cloud

Splunk Versions: 8.1, 8.0

Platform: Platform Independent

We were on where Solarwinds AddOn worked fine:

- AWS Linux
- Splunk Enterprise 8.0.5
- Solarwinds addon version 1.1.0

Upgraded to:

- AWS Linux
- Splunk Enterprise 8.1
- Solarwinds addon version 1.1.0

So something must be wrong in the python code.
This is the line 388 it complain about in our splunkd.log file:

def validate(self, value, data):
import datetime
try:
datetime.datetime.strptime(value, self._format)
except ValueError, exc:
error = 'Wrong datetime with format "%s": %s' % (self._format, str(exc))
self.put_msg(error)
return False
return True

Re: SolarWinds app modular error.

rmorlen — Wed, 18 Nov 2020 12:31:25 GMT

You are seeing that the app is supposed to be compatible. It is not a Splunk Supported addon.

Re: SolarWinds app modular error.

hansuleberg — Wed, 18 Nov 2020 14:57:04 GMT

Hi.

But it has passed the splunk app inspect, and is listed as supported on Splunk Enterprise 8.1 and 8.x

I have a support ticket engineer looking into it now inside splunk.

Re: SolarWinds app modular error.

PG — Wed, 18 Nov 2020 14:59:27 GMT

Let me know what you find out. I had uninstalled the add -on and started over and as soon as I install a fresh copy it started with the same issue and didn't let me configure anything.

Re: SolarWinds app modular error.

asearson — Wed, 02 Dec 2020 16:02:19 GMT

We are also encountering this issue. Addon works fine with Splunk Enterprise 8.0.x, but fails when upgrading (or even fresh installs) on 8.1.x.

We also opened a Support ticket, but was immediately Rejected for the Unsupported App:

Having said that, there does appear to be a bit of interest from the Community and Splunk answers so hopefully the developers will see that. I note the latest version 1.1.0 was released in March 2020, well before Splunk 8.1, so as you have suggested it's not finding the right python libraries etc.

Looks like the author @ehaddad_splunk (?) is our only hope for an update.

Re: SolarWinds app modular error.

ehaddad_splunk — Wed, 02 Dec 2020 18:48:01 GMT

I havent tested it against 8.1. I will need to take a look and update accordingly.

The addon is only needed on the HWF - any chance you can keep the addon on an 8.0x forwarder?

Re: SolarWinds app modular error.

asearson — Wed, 02 Dec 2020 19:22:33 GMT

Thanks for the prompt reply @ehaddad_splunk, and thanks for your work on this AddOn! It's a great addition to our SIEM solution in ES.

Our Security team's workaround at the moment is using an older 8.0.4.1 Heavy Forwarder (HF) to run this specific SolarWinds AddOn, while the rest of the SplunkBase Apps are running on our recently upgraded 8.1.0 HF.

It's odd that the SplunkBase page shows Version 1.1.0 (March 30, 2020) as COMPATIBILITY for 8.1, as tho it had been properly vetted for release. However, if you look inside the TGZ download, there isn't the same aob_py2 and aob_py3 folders that we see in other 8.1 compatible apps from SplunkWorks , such as "Microsoft Azure Add on for Splunk" (June 2020):

Re: SolarWinds app modular error.

cchacon — Tue, 15 Dec 2020 17:05:25 GMT

Would be nice for the Splunk Devs to confirm if this TA will work on Enterprise 8.0+ or the latest ITSI version. My understanding is that the add-on will log inputs for SolarWinds query, alerts, or node inventory (esp useful with the major SolarWinds breach announced by Homeland Security as of Dec 14 2020).

Is this only for cloud or is it supported, as stated in release notes, for all tiers of Splunk? Looking for method of monitoring SolarWinds once they remove the Trojan DLL from their repo.

Re: SolarWinds app modular error.

cchacon — Wed, 23 Dec 2020 15:06:23 GMT

Have you been able to configure Splunk_TA_SolarWinds for Linux Splunk on-prem? We use the same

Re: SolarWinds app modular error.

rupert — Mon, 11 Jan 2021 06:13:46 GMT

Hi,

We are encountering same issue here with the Solarwinds add-on, after upgrading

from

SE 7.3.1 + Solarwinds Add-on 1.0.0

SE 8.1.0 + Solarwinds Add-on 1.1.0

Both versions of add-on are not working with the new version of SE. The configuration UI cannot be loaded and the modular input is also not pulling anything from Solarwinds.

May I check if there is any update to this issue please? Will there be an update of the add-on which is compatible with SE 8.1.x please?

Thank you

Re: SolarWinds app modular error.

loconnor — Wed, 13 Jan 2021 23:08:51 GMT

I got this to work on Splunk 8.1.1 by adding:

python.version = python2

to all sections in inputs.conf and restmap.conf. Could probably add it to a [default] section in both of those, but it certainly works by adding it to the individual stanzas (in local.)

Re: SolarWinds app modular error.

cchacon — Wed, 13 Jan 2021 23:27:33 GMT

It may just be a simple TA update to python3 then.

Python2 is deprecated from my understanding. Good to know!

Re: SolarWinds app modular error.

rupert — Thu, 14 Jan 2021 06:49:11 GMT

I tried this method and it works!

I added the following to all the input stanzas in local.

I also added it into restmap.conf (in local) but encountered error saying that the parameter is not valid for the stanzas.

So I guess just by adding to the inputs.conf it is working.

python.version = python2

Both the UI of the add-on and the log collection are working fine.

I am using SE 8.1.0 with Solarwinds Add-on 1.1.0

and I configured the add-on for inventory and alert inputs.

Thank you very much to @loconnor

Re: SolarWinds app modular error.

mfortn_22 — Wed, 27 Jan 2021 17:13:11 GMT

@rupert @loconnor Could you expand on which specific inputs.conf file(s) you added the 'python.version = python2' statement too. Would this be within the splunk_TA_solarwinds folder or another like the system folder? One of out admins upgraded last night and we too are running into this.

Re: SolarWinds app modular error.

loconnor — Wed, 27 Jan 2021 17:18:29 GMT

lance@mono Splunk_TA_SolarWinds % head -4 local/restmap.conf local/inputs.conf ==> local/restmap.conf <== [default] python.version = python2 ==> local/inputs.conf <== [default] python.version = python2 index = solarwinds lance@mono Splunk_TA_SolarWinds %

Re: SolarWinds app modular error.

ehaddad_splunk — Wed, 27 Jan 2021 17:39:12 GMT

should be all stanzas under inputs.conf and restmap.conf. Should have an updated version with a fix that would not require this workaround. Send me an email and I can you an updated copy of the TA. Otherwise, i might make it available on splunkbase soon.