All Apps and Add-ons

Splunk AWS add-on configuration page just has endless "loading"

Path Finder

I just set up a heavy forwarder with the AWS add-on.  I launched the app and went to the configuration page but all I get is the spinning 'Loading' icon.

I looked over the previous question like this:


But I'm not using any Google services at all nor do I have any file "/etc/boto.cfg ".


When I look through the Splunkd logs I see this:


+0000 ERROR AdminManagerExternal [1021 TcpChannelThread] - Stack trace from python handler:
Traceback (most recent call last):
File "/home/y/var/splunk/lib/python3.7/site-packages/splunk/", line 114, in init_persistent
File "/home/y/var/splunk/lib/python3.7/site-packages/splunk/", line 637, in execute
if self.requestedAction == ACTION_LIST: self.handleList(confInfo)
File "/home/y/var/splunk/etc/apps/Splunk_TA_aws/bin/", line 58, in handleList
entity = client.Entity(self._service, uri % (service, LOGGING_ENDPOINTS[service]))
File "/home/y/var/splunk/etc/apps/Splunk_TA_aws/bin/3rdparty/python3/splunklib/", line 900, in __init__
self.refresh(kwargs.get('state', None)) # "Prefresh"
File "/home/y/var/splunk/etc/apps/Splunk_TA_aws/bin/3rdparty/python3/splunklib/", line 1039, in refresh
self._state =
File "/home/y/var/splunk/etc/apps/Splunk_TA_aws/bin/3rdparty/python3/splunklib/", line 1009, in get
return super(Entity, self).get(path_segment, owner=owner, app=app, sharing=sharing, **query)
File "/home/y/var/splunk/etc/apps/Splunk_TA_aws/bin/3rdparty/python3/splunklib/", line 766, in get
File "/home/y/var/splunk/etc/apps/Splunk_TA_aws/bin/3rdparty/python3/splunklib/", line 290, in wrapper
return request_fun(self, *args, **kwargs)
File "/home/y/var/splunk/etc/apps/Splunk_TA_aws/bin/3rdparty/python3/splunklib/", line 71, in new_f
val = f(*args, **kwargs)
File "/home/y/var/splunk/etc/apps/Splunk_TA_aws/bin/3rdparty/python3/splunklib/", line 680, in get
response = self.http.get(path, all_headers, **query)
File "/home/y/var/splunk/etc/apps/Splunk_TA_aws/bin/3rdparty/python3/splunklib/", line 1184, in get
return self.request(url, { 'method': "GET", 'headers': headers })
File "/home/y/var/splunk/etc/apps/Splunk_TA_aws/bin/3rdparty/python3/splunklib/", line 1242, in request
response = self.handler(url, message, **kwargs)
File "/home/y/var/splunk/etc/apps/Splunk_TA_aws/bin/3rdparty/python3/splunklib/", line 1383, in request
connection.request(method, path, body, head)
File "/home/y/var/splunk/lib/python3.7/http/", line 1277, in request
self._send_request(method, url, body, headers, encode_chunked)
File "/home/y/var/splunk/lib/python3.7/http/", line 1323, in _send_request
self.endheaders(body, encode_chunked=encode_chunked)
File "/home/y/var/splunk/lib/python3.7/http/", line 1272, in endheaders
self._send_output(message_body, encode_chunked=encode_chunked)
File "/home/y/var/splunk/lib/python3.7/http/", line 1032, in _send_output
File "/home/y/var/splunk/lib/python3.7/http/", line 972, in send
File "/home/y/var/splunk/lib/python3.7/http/", line 1439, in connect
File "/home/y/var/splunk/lib/python3.7/http/", line 944, in connect
(,self.port), self.timeout, self.source_address)
File "/home/y/var/splunk/lib/python3.7/", line 728, in create_connection
raise err
File "/home/y/var/splunk/lib/python3.7/", line 716, in create_connection
ConnectionRefusedError: [Errno 111] Connection refused

Which looks like it's trying to autoconfigure itself like mentioned in:


But this is not running in AWS so I planned to manually configure it.  However I cannot because of the above problem.  How do I fix this?



Splunk AWS add-on 5.2.0

Labels (1)
Tags (1)
0 Karma


I would be interested to see why there is a connection refused message. Is it possible to open up the Developer Tools in Chrome and see if there are any errors in either the console or the network tab? That could very well help determine why you are hanging at a Loading screen. 

Just an FYI I did just spin up an instance in GCP with Splunk and version 5.2.0 of the Splunk Add-on for Amazon Web Services, and I was able to get past the spinning Loading Screen. So I'm sure we can troubleshoot and figure out what is preventing you from getting beyond this. 


Screen Shot 2021-10-21 at 10.08.38 PM.png

0 Karma

Path Finder

I see the following errors in the console and network tabs.  BTW, I use Waterfox and not Chrome.


Screen Shot 2021-10-25 at 12.07.36 PM.pngScreen Shot 2021-10-25 at 12.10.19 PM.pngScreen Shot 2021-10-25 at 12.11.17 PM.pngScreen Shot 2021-10-25 at 12.12.01 PM.pngScreen Shot 2021-10-25 at 12.12.17 PM.pngScreen Shot 2021-10-25 at 12.12.31 PM.png


0 Karma


We are seeing the same issue.  Installation message that won't allow us to proceed any further.


Splunk Enterprise version of heavy forwarder:

Splunk Add-on for AWS: 5.2.0



0 Karma
Get Updates on the Splunk Community!

Announcing General Availability of Splunk Incident Intelligence!

Digital transformation is real! Across industries, companies big and small are going through rapid digital ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...