topic Re: How do I resolve this error: [SPLUNKD] Not Found? in Getting Data In

How do I resolve this error: [SPLUNKD] Not Found?

ServiceNow_SecO — Tue, 13 Dec 2022 20:17:49 GMT

Hi,

I am using the Splunk version 8.2.8

when I am trying to open the setup page of Splunk Add-on : ServiceNow Security Operations Integration

Then i am getting below error on console

Can anyone please help on this?

Above error is not coming in Splunk version 9.0.2. Add-on working fine with this version.

Re: How do I resolve this error: [SPLUNKD] Not Found?

sloshburch — Mon, 28 Nov 2022 20:03:49 GMT

I don't typically start with the browser tools when working on issues with Splunk. At least not at first.

What is the actual issue in the Splunk UI? What is not functionally working the way you expect? How can someone reproduce this issue? Which app does this correspond to, including the link to that app on Splunkbase, so others can reproduce this? (There is no app on Splunkbase called "Splunk Add-on : ServiceNow Security Operations Integration"). Please be as specific as possible so others can help reproduce the questioned behavior.

I see there are 10 messages (upper right). What are they? What errors did you see in the _internal logs that were related to the issue you are experiencing.

Re: How do I resolve this error: [SPLUNKD] Not Found?

ServiceNow_SecO — Tue, 29 Nov 2022 10:06:59 GMT

Hi @sloshburch

Please see the below mention steps to reproduce the issue.

Step1 : download the Add-on - https://splunkbase.splunk.com/app/3921

Step2 : Install This Add-on in Splunk version 8.2.8

Step3 : Once installation succeed. Click on setup page link (see below screenshot)

Step4 : Once clicked. open Developer tool and check the error in Console (see below screenshot)

Actual Problem is related to call API

when we click on setup page one API is getting call from backend and its saying that not able to find that API thats why 404 error is coming.

Even though if you install same Add-on https://splunkbase.splunk.com/app/3921 in Splunk version 9.0.1, Its working fine. able to hit API and fetching the response.

Way how we are calling API From Javascript file

var endpoint = new splunkjs.Service.Endpoint(splunk_js_sdk_service, "/TA-ServiceNow-SecOps_setup/myinstance");

This above endpoint is properly configured in "restmap.conf" file and working fine in splunk version 9.0.1 as mentioned above

how we configured end point in restmap.conf file

[admin:sn_sec_instance]

match = /TA-ServiceNow-SecOps_setup

members = myinstance

[admin_external:myinstance]

handlertype = python

handlerfile = sn_instance.py

handleractions = list, edit, create

python.version = python3

we couldn't able to find any log in index="_internal" related to this issue.

Let me know, if further info required from my side

Re: How do I resolve this error: [SPLUNKD] Not Found?

splunkian — Tue, 29 Nov 2022 15:14:36 GMT

I tested this on a Docker instance running Splunk 8.2.8 and by default the app loads fine with no error.

However, if I remove the web.conf from the app, then I get the exact error you are seeing.

Is it possible the web.conf file is missing or something with permissions is preventing Splunk from seeing the app's web.conf file on your 8.2.8 instance?

Re: How do I resolve this error: [SPLUNKD] Not Found?

Brett — Thu, 01 Dec 2022 21:35:39 GMT

The developer appears to be using the wrong REST URL

It should be
splunkd/__raw/services/TA-ServiceNow-SecOps_Setup

I would report this to customersupport@servicenow.com