topic Re: Are Splunk Manager error messages logged anywhere? in Monitoring Splunk

Are Splunk Manager error messages logged anywhere?

Ant1D — Fri, 03 Feb 2012 14:46:20 GMT

Hey,

In the past, when I have opened the Splunk Manager page in Splunk web, I have seen a red error message appear at the top of the screen with the following example error:

Misconfigured view 'view_1' - Unknown parameter 'width' is defined for module SimpleResultsTable. Make sure the parameter is specified in SimpleResultsTable.conf.

Do these error messages get logged in Splunk's internal indexes (e.g. _internal, _audit)?

It would be good to know if these messages are logged anywhere. I am using Splunk v4.2.1

Thanks in advance for your help.

Re: Are Splunk Manager error messages logged anywhere?

ChrisG — Fri, 03 Feb 2012 22:15:39 GMT

My guess is that this would be in python.log, which is indexed in _internal. There's some information that might help in the Troubleshooting Manual: http://docs.splunk.com/Documentation/Splunk/latest/Troubleshooting/WhatSplunklogsaboutitself.

Re: Are Splunk Manager error messages logged anywhere?

araitz — Fri, 03 Feb 2012 23:28:45 GMT

Try:

index=_internal source=*web_service.log

Re: Are Splunk Manager error messages logged anywhere?

Ant1D — Fri, 10 Feb 2012 10:51:58 GMT

Thanks, I tried this but I couldn't find any errors that I have seen in Splunk Manager.

Re: Are Splunk Manager error messages logged anywhere?

Ant1D — Fri, 10 Feb 2012 11:32:53 GMT

Thanks, I tried having a look at python.log but couldn't find any similar error messages.

Re: Are Splunk Manager error messages logged anywhere?

jrodman — Tue, 05 May 2015 22:01:23 GMT

Years later.. No. The bulletin board messages are not attached to a log. The code paths that produce bulletin board messages need to pass the relevant information to logging channels when appropriate as well as the bulletin board. Thus, some messages (for example search output) may appear in search.log for relevant searches, and many important status messages from the backend are written to splunkd.log as well as the messages system.

For the old python modules system that would have been handling that sort of view validation when this question was asked, it should have logged to web_service.log, but apparently did not.

Re: Are Splunk Manager error messages logged anywhere?

drutstein — Tue, 16 Apr 2024 20:52:17 GMT

It doesn't appear that these get logged since the bulletin board does not log these into an index, but they are accessible via REST:

| rest /services/admin/messages splunk_server=local

More details found here:
https://dev.splunk.com/enterprise/docs/developapps/manageknowledge/managebulletins/