REST endpoint error

[galineth]

I get an error on the Forwarder Summary dashboard that I am not sure how to tackle. If I run a get request locally from the same machine with
the same URI and the same user, I get a response, only the UI seems to not be able to connect.

[mdsnmss]

Hi @galineth. I'm the creator of the Unified Forwarder Monitoring App for Splunk. Is there a specific panel you are seeing the error on or is it all of them? The base search should be in all panels so I'd expect if you see this in one you'd see it in the others.

What version of Splunk are you currently on and are you able to run any of these searches from the GUI?

| rest /services/deployment/server/clients splunk_server=*
| rest /services/deployment/server/clients splunk_server=127.0.0.1
| rest /services/deployment/server/clients

It looks like this is the part that your search is erroring out on. It should take splunk_server from the peers you have added as search peers on the host you are searching from.

[galineth]

Hey @mdsnmss , thanks for your quick reply.

The error is present on all Panels.

Splunk Version is 7.2.9.1

The searches give the following results (in your order):

• Results from Deployment Server + 3x error (for 127.0.0.1 and two clustered indexers)
• No results + no error
• Results from Deployment Server + 3x error (for 127.0.0.1 and two clustered indexers)

Configured search Peers are: Deployment Server, Clustered Indexer 1 & 2