All Apps and Add-ons

Splunk for Cisco Identity Services (ISE): Why am I getting error "Splunkd daemon is not responding...The read operation timed out" trying to set up the app?

scottmwa
Explorer

When trying to set up this app, I get the following error:

Splunk could not perform action for resource apps/local/Splunk_TA_cisco-ise Splunkd daemon is not responding: ('Error connecting to /servicesNS/sorr/Splunk_TA_cisco-ise/apps/local/Splunk_TA_cisco-ise/setup: The read operation timed out',)
There was an error retrieving the configuration, can not process this page.

Splunk is running, and searching. It is on Server 2012. I do also have the Cisco ISE app (Splunk_CiscoISE) app installed, but it is currently disabled.

This is on a completely fresh Splunk install with only two other sources set up for the Cisco Security suite - TA Cisco ASA and TA Cisco IPS. Any help in how to find what is causing this error would be appreciated!

1 Solution

jconger
Splunk Employee
Splunk Employee

What version of Splunk are you using? There is a known issue (ADDON-2610/SPL-91709) for 6.3 and below for setting up this add-on in Windows environments -> http://docs.splunk.com/Documentation/AddOns/released/CiscoISE/Releasenotes

View solution in original post

0 Karma

jconger
Splunk Employee
Splunk Employee

What version of Splunk are you using? There is a known issue (ADDON-2610/SPL-91709) for 6.3 and below for setting up this add-on in Windows environments -> http://docs.splunk.com/Documentation/AddOns/released/CiscoISE/Releasenotes

0 Karma

LarsN
Explorer

Also running Server 2012
The Splunkd.log says about this incident:

08-15-2016 15:14:46.166 +0200 WARN  SetupAdminHandler - Cannot find field='ise.host' in url='/splunktaciscoise/workflow_sidecar/pxGrid_QuarantineByIP/' setting value to empty string
08-15-2016 15:14:46.166 +0200 WARN  HttpListener - Socket error from 127.0.0.1 while accessing /servicesNS/admin/Splunk_TA_cisco-ise/apps/local/Splunk_TA_cisco-ise/setup: Winsock error 10053
0 Karma
Get Updates on the Splunk Community!

New Case Study Shows the Value of Partnering with Splunk Academic Alliance

The University of Nevada, Las Vegas (UNLV) is another premier research institution helping to shape the next ...

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...