topic Re: Custom REST Endpoints in Splunk Enterprise

Custom REST Endpoints not working?

silambarasu — Fri, 30 Jun 2023 15:47:31 GMT

We have created the custom REST endpoints and its working in Splunk server 8.1.3.But same REST end point is not working another splunk server and it show "404 not found"

Re: Custom REST Endpoints

isoutamo — Wed, 28 Jun 2023 08:29:31 GMT

Could you tell more about those environments and your app?

If your app is using python2 and the another splunk server is 9.x then there is no python2 only python3. Also (if I recall right) 8.2.x has python3 as a default, but 8.1.x has still python2 as default one.

Re: Custom REST Endpoints

silambarasu — Wed, 28 Jun 2023 09:33:53 GMT

working splunk server:

Splunk Enterprise
Version:

8.1.3

Build:

63079c59e632

Server:

PC-317YLL3

Products:

itsi

not working splunk server:

Version:

8.1.3

Build:

63079c59e632

Server:

PC-6SNVCL3

Re: Custom REST Endpoints

isoutamo — Wed, 28 Jun 2023 11:29:15 GMT

Could it be that your REST end point is somehow dependent on ITSI?

Re: Custom REST Endpoints

silambarasu — Wed, 28 Jun 2023 11:48:37 GMT

how we get those info...can you pls tell where to check

Re: Custom REST Endpoints

silambarasu — Wed, 28 Jun 2023 11:59:21 GMT

App is installing in new splunk server with out any issue but Custom REST Endpoints only not showing

Re: Custom REST Endpoints

dural_yyz — Wed, 28 Jun 2023 12:56:11 GMT

You have moved the app from a server with ITSI to a server without ITSI. The permissions might be tied to a role specific to the ITSI app which might not exist on the new server. Look into your app.conf file for hints.

Re: Custom REST Endpoints

silambarasu — Thu, 29 Jun 2023 05:03:34 GMT

looks like same thing only present on both servers...any other things need to check

Re: Custom REST Endpoints

dural_yyz — Thu, 29 Jun 2023 11:24:39 GMT

I've never developed custom endpoints but the 404 still makes me think of a permissions issue. Here is a link to developers explanation of permissions. Calls out specifically authorize.conf and restmap.conf files as requirements.

I would focus on roles and script folder locations as leading causes of 404 not found.

https://dev.splunk.com/enterprise/docs/devtools/customrestendpoints/customrestmanageaccess/

Re: Custom REST Endpoints

silambarasu — Thu, 29 Jun 2023 13:44:19 GMT

No module named 'splunklib'...this error is coming.so,endpoints are not mapped...
can you pls help how to fix this error though we have bundled the splunk libraries

Re: Custom REST Endpoints

silambarasu — Thu, 29 Jun 2023 13:45:12 GMT

No module named 'splunklib'...this error is coming.so,endpoints are not mapped... can you pls help how to fix this error though we have bundled the splunk libraries

Re: Custom REST Endpoints

isoutamo — Thu, 29 Jun 2023 14:27:00 GMT

This means that you haven't Splunk Python SDK on your new environment. Usually this is under each app time by time it could be also globally shared from some other apps. Probably this is done on ITSI?

Re: Custom REST Endpoints

silambarasu — Thu, 29 Jun 2023 14:55:08 GMT

is there way to install only splunklib module or bundle with an app?

Re: Custom REST Endpoints

isoutamo — Thu, 29 Jun 2023 15:35:33 GMT

You could found instructions easily by Google. But develop and test that app 1st on your test environment and when it’s ready then install it as an app to your production.