All Apps and Add-ons

Splunk Website Monitoring stops working if I add more app URLS to be monitored!

vsrigane
Explorer

Hello Luke & Team,

I am trying to configure Splunk Website Monitoring app to probe new application URLS. It was working fine, until the count was 40 but not I am up to 60 URL count and it has stopped working.

I tried reducing the concurrent thread limit to 5 on the website_monitoring.conf file and also I have increased the system resources for my Splunk Enterprise installed machine for CPU. Still it does not work.

Any help or suggestion or config changes needed would be greatly helpful and appreciated.

Thanks,
Vishwa

0 Karma
1 Solution

LukeMurphey
Champion

I suspect one of the inputs is missing the interval parameter. I was able to reproduce this using the following entry in inputs.conf:

[web_ping://textcritical.com]
title = textcritical.com
url = https://textcritical.com
disabled = 0

Note that this can be fixed by specifying the interval parameter:

[web_ping://textcritical.com]
title = textcritical.com
url = https://textcritical.com
disabled = 0
interval = 10m

You could go through each input in the user interface and set the interval accordingly.

Meanwhile, I have a bug open in order to improve the app such that it provides better error messaging: https://lukemurphey.net/issues/2446

View solution in original post

0 Karma

LukeMurphey
Champion

I suspect one of the inputs is missing the interval parameter. I was able to reproduce this using the following entry in inputs.conf:

[web_ping://textcritical.com]
title = textcritical.com
url = https://textcritical.com
disabled = 0

Note that this can be fixed by specifying the interval parameter:

[web_ping://textcritical.com]
title = textcritical.com
url = https://textcritical.com
disabled = 0
interval = 10m

You could go through each input in the user interface and set the interval accordingly.

Meanwhile, I have a bug open in order to improve the app such that it provides better error messaging: https://lukemurphey.net/issues/2446

0 Karma

vsrigane
Explorer

Hello Luke,

Thanks a lot for your prompt response. Yes, you were right, out of the 60 inputs I had, one of them missed to have the interval specified.

I made sure I specified the interval, also cross validated other inputs for naming convention for the intervals and restarted the Splunk Enterprise and now, I see the application is continue to work as before.

I will keep an eye out and monitor closely throughout this week to make sure there are no other hiccups.

Also, another point to let you know with regard to this app is that, if we add any new inputs via the web UI for the app, it is not getting added on the inputs.conf within the app on the server. The maximum inputs that were present on the inputs.conf was 15.

Not sure, if it has something to do with the app UI and backend sync, just wanted to let you know. Thanks and appreciate your assistance in this regard. Will look forward for your next push/release that would have better error message for this particular issue.

Thanks and regards,

Vishwa

0 Karma

LukeMurphey
Champion

Can look for some logs that may indicate the source of the problem? This search should surface them:

index=_internal (sourcetype=web_availability_modular_input ERROR) OR (traceback AND NOT sourcetype=splunkd_ui_access)
0 Karma

vsrigane
Explorer

@LukeMurphey

I am getting the following error for the last 24 hours when I try to run the search SPL query you provided on my search head.

Error Message:

2019-07-22 10:52:38,914 ERROR Execution failed
Traceback (most recent call last):
File "/opt/splunk/etc/apps/website_monitoring/bin/modular_input.zip/modular_input/modular_input_base_class.py", line 1083, in execute
self.do_run(in_stream, log_exception_and_continue=True)
File "/opt/splunk/etc/apps/website_monitoring/bin/modular_input.zip/modular_input/modular_input_base_class.py", line 964, in do_run
self.run(stanza, cleaned_params, input_config)
File "/opt/splunk/etc/apps/website_monitoring/bin/web_ping.py", line 695, in run
interval = cleaned_params["interval"]
KeyError: 'interval'

Kindly review and advise.

Thanks,
Vishwa

0 Karma

vsrigane
Explorer

Hello Luke,

Thanks for your response. I did try to search the log using the query you provided and I cannot find any error specific to website monitoring source type for the data input.

Also, I currently have the thread limit set to 10 (Have tried to set it to as low as 5 earlier) on the websitemonitoring.conf within the app. Also, I just configured the maxSockets and maxThreads to -1 on the server.conf for the Splunk Enterprise. It did not seem to fix the issue.

Let me know if you need any other inputs.

Thanks,
Vishwa

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...