All Apps and Add-ons

Why am I not gettting any data from an App Array Rest API (input)?

rgarcia
Engager

Hi All,

I installed an app with its TA addon, adjusted the FW rules, and created the inputs with the appropriate credentials...but I still don't see any data. 

Any help as where I can look to troubleshoot?

Labels (1)
Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust
We need a lot more information.
Which app and which TA did you install? Where did you install them? How did you install them? What does your Splunk architecture look like? How are the inputs defined? Are you looking in the right place(s) for the data? Have you looked at the logs? Are you sure there's data to be found?
---
If this reply helps you, an upvote would be appreciated.
0 Karma

rgarcia
Engager

of course, keep in mind I'm not all that familiar with splunk config. This splunk infrastructure was passed down to me.

 

I installed PureStorage app and the TA. They were installed on a indexer and heavy forwarder, our infrastructure consists of 6 indexers, 6 search heads, 1 cluster master, 1 deployment server, and 2 heavy forwarders. To answer your inputs question, how do I look that up? is it under the installed app (inputs.conf). Where do I look for issues in the logs? is it the ones in splunkhome/var

And, yes...I can see the data on the appliances and splunk would just feed off of that I suppose

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The app should be installed on all search heads.  Install the TA on both heavy forwarders.

Inputs will be defined in the TA under $SPLUNK_HOME/etc/apps/<app-name>/default/inputs.conf and $SPLUNK_HOME/etc/apps/<app-name>/local/inputs.conf.  You may also find it in the HF's UI under Settings->Data inputs.

The best way to look at the logs is by using Splunk.  Search for 

index=_internal source="*splunkd.log"

Have you seen the Inherited Deployments manual at https://docs.splunk.com/Documentation/Splunk/7.3.0/InheritedDeployment/Introduction ?

---
If this reply helps you, an upvote would be appreciated.
0 Karma

rgarcia
Engager

Thanks for the information.

This is what I'm getting from the logs

ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/PureStorage-TA/bin/PureStorage_rest.py" /opt/splunk/etc/apps/PureStorage-TA/bin/requests/packages/urllib3/connectionpool.py:768: InsecureRequestWarning: Unverified HTTPS request is being made. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.org/en/latest/security.html

 

how do I go about fixing this?

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!