Can't launch Splunk for Blue Coat app

[joelrosado]

Hi...

I followed the setup guide for the BlueCoat app, and Splunk is getting the events just fine. (Results are returned in search when I run a sourcetype=bcoat_proxysg search). However when I try to start the BlueCoat app from the launcher I get the following error:

**

500 Internal Server Error KeyError:
'SplunkforBlueCoat' This page was
linked to from
http://{myhostname}:8000/en-US/app/launcher/home.
Debugging information You are using
{myhostname}:8000, which is connected
to splunkd @000 at
https://127.0.0.1:8089 on Wed Apr 20
15:19:21 2011.

**

Any ideas?

[joelrosado]

Not seeing a whole lot of info in the web_access and web_service logs:

web_service.log:

KeyError: 'SplunkforBlueCoat'

2011-04-20 14:52:47,490
INFO utility:121 - name=javascript,
class=Splunk.Session,
userAgent=Mozilla/5.0 (Macintosh;
Intel Mac OS X 10.6; rv:2.0)
Gecko/20100101 Firefox/4.0,
platform=MacIntel,
appCodeName=Mozilla, appName=Netscape,
appVersion=5.0 (Macintosh),
language=en-US, oscpu=Intel Mac OS X
10.6, product=Gecko, productSub=20100101,
buildID=20110318052756, top=0,
height=1024, width=1280, left=0,
pixelDepth=24, colorDepth=24,
availWidth=1280, availHeight=943,
availLeft=0, availTop=22,
documentURL=http://SERVERNAME:8000/en-US/app/launcher/home,
documentReferrer=http://SERVERNAME:8000/en-US/app/SplunkforBlueCoat/proxysg_overview,
flash=10.2.152,
Splunk.Session.START_EVENT fired @Wed
Apr 20 2011 14:52:42 GMT-0400 (EDT)

web_access.log

MYWORKSTATIONIP - - [20/Apr/2011:14:51:22] "GET
/en-US/static/@000:0/app/SplunkforBlueCoat/screenshot.png
HTTP/1.1" 200 200210
"http://SERVERNAME:8000/en-US/app/launcher/home"
"Mozilla/5.0 (Macintosh; Intel Mac OS
X 10.6; rv:2.0) Gecko/20100101
Firefox/4.0"
MYWORKSTATIONIP - - [20/Apr/2011:14:51:50] "GET
/en-US/app/SplunkforBlueCoat HTTP/1.1"
303 134
"http://SERVERNAME:8000/en-US/app/launcher/home"
"Mozilla/5.0 (Macintosh; Intel Mac OS
X 10.6; rv:2.0) Gecko/20100101
Firefox/4.0"
MYWORKSTATIONIP - - [20/Apr/2011:14:51:51] "GET
/en-US/app/SplunkforBlueCoat/proxysg_overview
HTTP/1.1" 500 14555
"http://SERVERNAME:8000/en-US/app/launcher/home"
"Mozilla/5.0 (Macintosh; Intel Mac OS
X 10.6; rv:2.0)

[joelrosado]

Any ideas? I dont see a whole lot of useful info in the logs. Am I missing something?

[netwrkr]

Being as you are getting a 500 ISE I would start with the "web_access.log" and "web_service.log". You are looking for any error conditions that could shed some more light on your issue.

[LukeMurphey]

Try running a search against the internal index for errors. For example the following tends to be good at finding problems: index=_internal error

[joelrosado]

What specifically am I looking for? I only saw a couple references in splunkd.log, and didnt seem like anything too pertinent.

04-20-2011 15:11:13.926 INFO IniFile - Renamed C:\Program Files\Splunk\etc\apps\SplunkforBlueCoat\metadata\local.meta.tmp.3068 to C:\Program Files\Splunk\etc\apps\SplunkforBlueCoat\metadata\local.meta: Rename succeeded in 1 attempt(s) made between Wed Apr 20 15:11:13 2011 and Wed Apr 20 15:11:13 2011

[netwrkr]

Have you looked at the splunk log files? $SPLUNK_HOME/var/log/splunk/* ?