All Apps and Add-ons

Splunk Common Information Model App -- When I navigate to the app setup screen, no settings appear

sebastianszykie
Explorer

Background:
Developer License
Splunk Enterprise 6.6.3 installed
Installed CIM App 4.9

Problem:
After successful installation of the CIM App, when I browse to the app setup screen, no settings appear. I restarted Splunk services, uninstalled and reinstalled the app and the issue persists.

If I install the app and view the corresponding datasets first before going to the setup page, the dataset page loads. After I go to the setup page, the datasets fail to load.

0 Karma

tkomatsubara_sp
Splunk Employee
Splunk Employee

Hello!

  1. Just create "$SPLUNK_HOME/etc/apps/Splunk_SA_CIM/local/web.conf" and put the below lines into it.

    [expose:admin_macros]
    pattern = admin/macros

    [expose:admin_macros_ELEMENT]
    pattern = admin/macros/*
    methods = GET,POST

  2. Restart your Splunk.

Tested:

deebinshm
New Member

Have observed the following in the browser console, unfortunately no idea how to resolve:

VM1006:1 GET http:///en-US/splunkd/_raw/services/admin/macros?output_mode=json&search=name%3Dcim*indexes&count=-1&=1506592708851 404 (Not Found)

0 Karma

harsmarvania57
Ultra Champion

Looks like browser related issue, tried in IE not working. When tried in Firefox it's working fine.

0 Karma

deebinshm
New Member

Also tried 3 different browsers with the same result, an almost blank page with CIM Setup as header and a grey line.

Interestingly, it was working at one point and then started to display the page as described above. No changes made to the browser.

0 Karma

sebastianszykie
Explorer

I tried 3 different ones and had the same problem in each.

0 Karma

dajomas
Path Finder

In our environment, we noticed that the CIM setup screen is not showing up when accessed via a virtual desktop but when accessed from a physical desktop, the setup screen comes up as expected.

Could this be desktop resource related?

0 Karma
Get Updates on the Splunk Community!

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...

Industry Solutions for Supply Chain and OT, Amazon Use Cases, Plus More New Articles ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Enterprise Security Content Update (ESCU) | New Releases

In November, the Splunk Threat Research Team had one release of new security content via the Enterprise ...