In my Splunk Cloud environment, both with v1.2 and v1.3, I am receiving excessive _internal error logs such as the ones below:
10-29-2018 04:03:48.419 +0000 WARN ConfObjectManagerDB - /opt/splunk/etc/apps/aplura_viz_donut/metadata/default.meta, line 9: Error parsing setting: export = system[visualizations/markdown] 2018-10-29 04:17:11,296 INFO [<HOST ID>] error:133 - Masking the original 404 message: 'Trying to reach the "aplura_viz_donut" app which does not have a User Interface.' with 'Page not found!' for security reasons
Are these known issues?
As we are Cloud, we have no access to the .conf file, however the app is disabled in the UI. Also, a REST call confirms that, unless I am misreading....
<s:key name="eai:appName">system</s:key> <s:key name="eai:userName">nobody</s:key> <s:key name="is_manageable">0</s:key> <s:key name="is_visible">0</s:key> <s:key name="label">Donut Viz C3</s:key> <s:key name="show_in_nav">0</s:key>
It looks like you or one of your users are trying to access this app which doesn't have a web interface. Have you tried disabling this app from being visible so users can't access it?
See here, at the bottom of the page it tells you to disable visibility for users