I just set up a heavy forwarder with the AWS add-on. I launched the app and went to the configuration page but all I get is the spinning 'Loading' icon.
I looked over the previous question like this: https://community.splunk.com/t5/All-Apps-and-Add-ons/Splunk-Add-on-for-AWS-Hangs/m-p/316801
But I'm not using any Google services at all nor do I have any file "/etc/boto.cfg ".
When I look through the Splunkd logs I see this:
+0000 ERROR AdminManagerExternal [1021 TcpChannelThread] - Stack trace from python handler:
Traceback (most recent call last):
File "/home/y/var/splunk/lib/python3.7/site-packages/splunk/admin.py", line 114, in init_persistent
hand.execute(info)
File "/home/y/var/splunk/lib/python3.7/site-packages/splunk/admin.py", line 637, in execute
if self.requestedAction == ACTION_LIST: self.handleList(confInfo)
File "/home/y/var/splunk/etc/apps/Splunk_TA_aws/bin/splunk_ta_aws_rh_settings.py", line 58, in handleList
entity = client.Entity(self._service, uri % (service, LOGGING_ENDPOINTS[service]))
File "/home/y/var/splunk/etc/apps/Splunk_TA_aws/bin/3rdparty/python3/splunklib/client.py", line 900, in __init__
self.refresh(kwargs.get('state', None)) # "Prefresh"
File "/home/y/var/splunk/etc/apps/Splunk_TA_aws/bin/3rdparty/python3/splunklib/client.py", line 1039, in refresh
self._state = self.read(self.get())
File "/home/y/var/splunk/etc/apps/Splunk_TA_aws/bin/3rdparty/python3/splunklib/client.py", line 1009, in get
return super(Entity, self).get(path_segment, owner=owner, app=app, sharing=sharing, **query)
File "/home/y/var/splunk/etc/apps/Splunk_TA_aws/bin/3rdparty/python3/splunklib/client.py", line 766, in get
**query)
File "/home/y/var/splunk/etc/apps/Splunk_TA_aws/bin/3rdparty/python3/splunklib/binding.py", line 290, in wrapper
return request_fun(self, *args, **kwargs)
File "/home/y/var/splunk/etc/apps/Splunk_TA_aws/bin/3rdparty/python3/splunklib/binding.py", line 71, in new_f
val = f(*args, **kwargs)
File "/home/y/var/splunk/etc/apps/Splunk_TA_aws/bin/3rdparty/python3/splunklib/binding.py", line 680, in get
response = self.http.get(path, all_headers, **query)
File "/home/y/var/splunk/etc/apps/Splunk_TA_aws/bin/3rdparty/python3/splunklib/binding.py", line 1184, in get
return self.request(url, { 'method': "GET", 'headers': headers })
File "/home/y/var/splunk/etc/apps/Splunk_TA_aws/bin/3rdparty/python3/splunklib/binding.py", line 1242, in request
response = self.handler(url, message, **kwargs)
File "/home/y/var/splunk/etc/apps/Splunk_TA_aws/bin/3rdparty/python3/splunklib/binding.py", line 1383, in request
connection.request(method, path, body, head)
File "/home/y/var/splunk/lib/python3.7/http/client.py", line 1277, in request
self._send_request(method, url, body, headers, encode_chunked)
File "/home/y/var/splunk/lib/python3.7/http/client.py", line 1323, in _send_request
self.endheaders(body, encode_chunked=encode_chunked)
File "/home/y/var/splunk/lib/python3.7/http/client.py", line 1272, in endheaders
self._send_output(message_body, encode_chunked=encode_chunked)
File "/home/y/var/splunk/lib/python3.7/http/client.py", line 1032, in _send_output
self.send(msg)
File "/home/y/var/splunk/lib/python3.7/http/client.py", line 972, in send
self.connect()
File "/home/y/var/splunk/lib/python3.7/http/client.py", line 1439, in connect
super().connect()
File "/home/y/var/splunk/lib/python3.7/http/client.py", line 944, in connect
(self.host,self.port), self.timeout, self.source_address)
File "/home/y/var/splunk/lib/python3.7/socket.py", line 728, in create_connection
raise err
File "/home/y/var/splunk/lib/python3.7/socket.py", line 716, in create_connection
sock.connect(sa)
ConnectionRefusedError: [Errno 111] Connection refused
Which looks like it's trying to autoconfigure itself like mentioned in:https://docs.splunk.com/Documentation/AddOns/released/AWS/Setuptheadd-on#Find_an_IAM_role_within_you...
But this is not running in AWS so I planned to manually configure it. However I cannot because of the above problem. How do I fix this?
Splunk-8.2.2
Splunk AWS add-on 5.2.0
I would be interested to see why there is a connection refused message. Is it possible to open up the Developer Tools in Chrome and see if there are any errors in either the console or the network tab? That could very well help determine why you are hanging at a Loading screen.
Just an FYI I did just spin up an instance in GCP with Splunk 8.2.2.1 and version 5.2.0 of the Splunk Add-on for Amazon Web Services, and I was able to get past the spinning Loading Screen. So I'm sure we can troubleshoot and figure out what is preventing you from getting beyond this.
I see the following errors in the console and network tabs. BTW, I use Waterfox and not Chrome.
We are seeing the same issue. Installation message that won't allow us to proceed any further.
Splunk Enterprise version of heavy forwarder: 8.2.2.1
Splunk Add-on for AWS: 5.2.0