All Apps and Add-ons

Cisco AMP for Endpoints Events Input: Saving a new Input returns status 404

taasai
New Member

Hi,
WHen I am trying to save a new Input, the following response is coming back.
"Input could not be saved:
the server responded with status 404"

I just copied and pasted the API I and the API Key that were shown on the AMP Console GUID, host name is "api.apjc.amp.cisco.com" as long as I use the APJC AMP tower. I checked the following document.
https://api-docs.amp.cisco.com/

Does anyone know how to configure and save the info?

0 Karma

jgedeon_splunk
Splunk Employee
Splunk Employee

It looks like this issue should be fixed in the next release version, the fix is here:

https://github.com/Cisco-AMP/amp4e_splunk_events_input/issues/1

0 Karma

hardikJsheth
Motivator

What error are you getting when you perform save operation in splunkd.log?

0 Karma

taasai
New Member

do you mean this file?
"source = /opt/splunk/var/log/splunk/splunkd.log"
I got no entry for the file when I save. But I got the following

2017-11-27 23:12:23,566 ERROR Amp4eEvents - API Error (status 400): {"version":"v1.2.0","metadata":{"links":{"self":"https://api.apjc.amp.cisco.com/v1/event_streams"}},"data":{},"errors":[{"error_code":400,"descriptio... Request","details":["the server responded with status 404"]}]}
host = localhost.localdomain source = /opt/splunk/var/log/splunk/amp4e_events_input.log sourcetype = amp4e_events_input-2

2017-11-27 23:12:23,566 INFO Amp4eEvents - Received response from ApiService (400)
host = localhost.localdomain source = /opt/splunk/var/log/splunk/amp4e_events_input.log sourcetype = amp4e_events_input-2

2017-11-27 23:12:22,672 INFO Amp4eEvents - ApiService - creating stream with params {'group_guid': [], 'name': u'host', 'event_type': [u'1090519054']}
host = localhost.localdomain source = /opt/splunk/var/log/splunk/amp4e_events_input.log sourcetype = amp4e_events_input-2

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...

Data Persistence in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. What happens if the OpenTelemetry collector ...

Thanks for the Memories! Splunk University, .conf25, and our Community

Thank you to everyone in the Splunk Community who joined us for .conf25, which kicked off with our iconic ...