Just started using Splunk and trying to get the Home Monitor app working. Followed the directions posted via YouTube, installed Home Monitor, then Google Maps, and rebooted after each. When I log back into Splunk, it asks me to run the initial Home Monitor setup. However, when I click the link, I get the following error:
Page not found!
View more information about your request (request ID = 5711245181da34bea438) in Search
This page was linked to from http://192.168.1.xxx:8000/en-US/manager/appinstall/homemonitor/checkstatus?
Any help would be appreciated.
Using following query, I am able to see data from my pfsense. However, using this home monitor app, none of dashboards are working. Could you please suggest what am I missing?
Do i need to setup special permission for home monitor app?
index=main sourcetype=pfsense host="pfSense.HOME.COM" filterlog
| rex "(?P<Month>\w+)\s(?<Day>\d{1,2})\s(?<Hour>\d{1,2}):(?<Minutes>\d{1,2}):(?<Seconds>\d{1,2})\s(?<RouterName>[^\.]+)\.(?<Suffix>[\S]+)\s\w+\s\d{1,2}\s\d{1,2}:\d{1,2}:\d{1,2}\s(?P<LogType>\w+):\s(?<RuleNumber>\d+),,,(?<Tracker>\d+),(?P<RealInterface>\w+),(?P<ReasonForLogEntry>\w+),(?P<Action>\w+),(?P<Direction>\w+),(?P<IPVersion>\w+),(?<tos>[^,]*),(?<ecn>[^,]*),(?<ttl>\d+),(?<id>\d+),(?<offset>\d+),(?<flags>\w+),(?<ProtocolId>\d+),(?<Protocol>[^,]+)"
| rex "^6,(?<class>\w+),(?<flowLabel>[^,]*),(?<hopLimit>\d+),(?<protocolText>[^,]+),(?<protocolId>\d+)"
| rex "tcp,(?:\d+,)?(?<Length>\d+),(?<SourceAddress>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}),(?<DestinationAddress>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}),(?<SourcePort>\d+),(?<DestinationPort>\d+),(?<DataLength>\d+),(?<TCPFlags>\w+),(?<SequenceNumber>[\d:]*),(?<AckNumber>\d*),(?<TCPWindow>\d*),(?<urg>[^,]*),(?<TCPOptions>.*)"
| rex "udp,(?:\d+,)?(?<Length>\d+),(?<SourceAddress>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}),(?<DestinationAddress>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}),(?<SourcePort>\d+),(?<DestinationPort>\d+),(?<DataLength>\d+)"
| rex "icmp,(?:\d+,)?(?<length>\d+),(?<SourceAddress>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}),(?<DestinationAddress>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}),(?<ICMPData>.*)"
| rex "(?<icmpType>request|reply),(?<EchoId>\d+),(?<EchoSequence>\d+)"
| rex "(?<icmpType>unreach|timexceed|paramprob|redirect|maskreply),(?<icmpDescription>.*)"
| rex "(?<icmpType>unreachproto),(?<icmpDestinationIpAddress>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}),(?<unreachableProtocolId>.*)"
| rex "(?<icmpType>unreachport),(?<icmpDestinationIpAddress>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}),(?<unreachableProtocolId>[^,]+),(?<unreachablePortNumber>\d+)"
| rex "(?<icmpType>needfrag),(?<icmpDestinationIpAddress>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}),(?<icmpMTU>\d+)"
| rex "(?<icmpType>tstamp),(?<icmp_id>[^,]*),(?<icmpSequence>[^,]*)"
| rex "(?<icmpType>tstampreply),(?<icmpId>[^,]*),(?<icmpSequence>[^,]*),(?<icmpOTime>\d*),(?<icmpRTime>\d*),(?<icmpTtime>\d*)"
| table Month,Day,Hour,Minutes,Seconds,RouterName,Suffix,LogType,RuleNumber,Tracker,RealInterface,ReasonForLogEntry,Action,Direction,IPVersion,tos,ecn,ttl,id,offset,flags,ProtocolId,Protocol,class,flowLabel,hopLimit,protocolText,protocolId,Length,SourceAddress,DestinationAddress,SourcePort,DestinationPort,DataLength,DataLength,TCPFlags,SequenceNumber,AckNumber,TCPWindow,urg,TCPOptions,ICMPData,icmpType,EchoId,EchoSequence,icmpDescription,icmpDestinationIpAddress,unreachableProtocolId,unreachablePortNumber,icmpMTU,icmpId,icmpSequence,icmpOTime,icmpRTime,icmpTtime
Please see https://answers.splunk.com/answers/440675/404-when-setting-up-home-monitor-app.html#answer-442616 for the workaround / fix for now. I will be working on a solution in the app in the next release.
Thanks
Kam
The quick fix is to go into the $SPLUNK_HOME/etc/apps/homemonitor/default/setup.xml
file and make the following edits:
Comment out the Windows bandwidth tests in the setup.xml file using the '< ! --' and '-- >' around the following stanza:
<block title="Enable Windows bandwidth tests" endpoint="data/inputs/script/" entity="%24SPLUNK_HOME%5Cetc%5Capps%5Chomemonitor%5Cbin%5Cspeedtest.bat">
<text>Enable Windows Bandwidth Test</text>
<input field="disabled">
<label>Disabled, please uncheck to enable.</label>
<type>bool</type>
</input>
<text>Interval for script default is 30 minutes or 1800 seconds</text>
<input field="interval">
<label>Time in seconds</label>
<type>text</type>
</input>
</block>
If you need to enable the Windows Bandwidth test, you can do it manually by making the following edit to your $SPLUNK_HOME/etc/apps/homemonitor/local/inputs.conf
file:
[script://$SPLUNK_HOME\etc\apps\homemonitor\bin\speedtest.bat]
disabled=0
This should be below the enabled UDP 514 input
I've updated the latest version of the app (4.5.1) to contain this fix.
I have not tested it out on Server 2012, but I can tell you the work around if you're having issues with setting up the app. Open your SPLUNK_HOME directory (I'll assume c:\Program Files\Splunk) and go to \etc\apps\homemonitor\ and create the local directory (if it hasn't been created already).
Create the file app.conf and use this stanza :
[install]
is_configured = 1
Crate the file inputs.conf and use this stanza :
[script://./bin/speedtest.bat]
disabled = 0
[udp://514]
disabled = 0
Now, once they are enabled just make sure that you have opened UDP 514 from your firewall / router to your Windows Server on the Windows Firewall.
Let me know how that works for you.
-Kam
I am running Home Monitor with Splunk 6.4.2 on linux (Ubuntu 16.04). I too was getting the same error and tried your solution above. That got me part of the way. Now I have a Home Monitor logo but when I click on it I get "App configuration...The "home | monitor > 4.5.0" app has not been fully configured yet." then I can click on a button that says "continue to app setup page." That takes me to
Page not found!
View more information about your request (request ID = 57a90af9f77fe8a04f4ed0) in Search
I guess I'm missing some additional items in the inputs.conf and app.conf files?
OK, weird. I logged back into my splunk instance today and the 'continue to app setup page' is working. It appears to be collecting data from my router. I'll give it a few hours and we'll see what happens.
What OS are you running your Splunk server? (Windows / Linux / Mac OS X)? What version of Splunk are you running? If you just click on the Splunk Logo, does it allow you to view the app?
I'm running Server 2012, with Splunk version 6.4.0. When I just click the Home Monitor logo on the left pane, I get a screen that says the app hasn't been fully configured yet.