Why am I receiving 500 error on the dashboard configuring Splunk App for Unix and Linux?

[a212830]

hI,

I installed the unix app, and now when I try to configure it, I get a 500 error in the dashboard. Looking at the logs, I see the following:

07-25-2014 22:22:48.724 -0400 ERROR ExecProcessor - message from "python /searchPool/etc/apps/splunk_app_for_nix/bin/scripted_inputs/dependency_manager.py"   File "/se
archPool/etc/apps/splunk_app_for_nix/bin/scripted_inputs/dependency_manager.py", line 44, in <module>
07-25-2014 22:22:48.724 -0400 ERROR ExecProcessor - message from "python /searchPool/etc/apps/splunk_app_for_nix/bin/scripted_inputs/dependency_manager.py"     version
 = en[APP_NAME]['version']
07-25-2014 22:22:48.724 -0400 ERROR ExecProcessor - message from "python /searchPool/etc/apps/splunk_app_for_nix/bin/scripted_inputs/dependency_manager.py"   File "/ap
ps/splunk/lib/python2.7/UserDict.py", line 23, in __getitem__
07-25-2014 22:22:48.724 -0400 ERROR ExecProcessor - message from "python /searchPool/etc/apps/splunk_app_for_nix/bin/scripted_inputs/dependency_manager.py"     raise K
eyError(key)
07-25-2014 22:22:48.724 -0400 ERROR ExecProcessor - message from "python /searchPool/etc/apps/splunk_app_for_nix/bin/scripted_inputs/dependency_manager.py" KeyError: '
splunk_app_for_nix'

Any suggestions?

[araitz · Accepted solution]

I would be willing to bet that you are using Splunk 6.1.x and that you have more than 30 apps installed (maybe you have Enterprise Security).

You can change the following line in splunk_app_for_nix/bin/scripted_inputs/dependency_manager.py:

     en = splunk.entity.getEntities('/apps/local', sessionKey=token)

To the following:

     en = splunk.entity.getEntities('/apps/local', count=0, sessionKey=token)

And things should work as expected. Alternatively, you can disable the scripted input in question, as long as you make sure that SA-nix and Splunk_TA_nix are copied from the app's install directory to your instance's $SPLUNK_HOME/etc/apps. In either case, you'll neeed to restart Splunk after you are done.

[araitz]

It tells Splunk to get all entities (in this case, the list of all apps installed on your system). The *nix app depends on the presence of the *nix TA (technology add-on) and SA (supporting add-on), and the above mentioned script is responsible for making sure they are installed.

[a212830]

Thanks. What does that do?