Why an Error when importing Add-on in Add-on Builder?

[wazuhtest]

Hi,
I'm trying to import an add-on made with Add-on builder but I get this error:
"The add-on project could not be imported because a problem occurred while loading the meta data."

When I try to do it using the CLI an error 35 is returned too. Also when I make a new test project,I export it and get the same error when importing it.

Thank you in advance

[jkat54]

This error happened to me when I was importing an app package instead of importing an app export.

They are two different things.

If you want to export your app from the addon builder so it can be imported into another add on builder, then go here:

http://localhost:8000/en-US/app/splunk_app_addon-builder/tab_home?view=main

Select the "Created with Add-on Builder" tab, and click export there.

If you dont have the app under that tab, then you need to export from the AoB you originally created the app with.

If you want to package your app for upload to splunkbase you go to the same link and click on "Validate & Package", then click on "Download Package" when it becomes available.

[Marius732]

There is no need to go back to the addon builder the app came from. As long as the app runs in a Splunk instance, this command can be used to generate an .spl that can be easily imported into any Splunk instance with Addon Builder:

sudo /opt/splunk/bin/splunk package app <PACKAGENAME>
Splunk username:
Splunk password:

All that is required is a Splunk UI account with admin rights from which the app is installed and is to be exported

[aa70627]

this was really helpful thanks

[kkrishnan_splun]

Thank you this helped me

[jkat54]

Pleased it helped someone else!

[chli_splunk]

KVStore is required to load your AoB metadata. Is your KVStore working well? Sometimes your SSL key might be expired and there would be some errors in your internal logs.

[wazuhtest]

I've tried to search for KVStore in "Manage apps -> browse more apps" and I can't find it and I didn't find much information about it. Please, could you tell me more details about it?
Thank you for your help

[chli_splunk]

You can try:

curl -k -s https://localhost:8089/services/server/info | grep kvstore

use this command on nix systems, which should return ready/starting/failed/disabled*

More info:
https://answers.splunk.com/answers/329766/what-is-the-command-to-check-kvstore-status.html
https://answers.splunk.com/answers/323356/kvstore-errors-does-not-start.html

[wazuhtest]

I tried it but there was an empty result. First the API returned a non-authorized type message, so I runned it like this:

curl -k -s https://admin:pass@localhost:8089/services/server/info | grep kvstore

I use Splunk 7.0.2 (build 03bbabbd5c0f)

Thanks again

[chli_splunk]

Are you sure you are running this command on your Splunk instance? It should return some basic info including KVStore status, otherwise your Splunk is not working well...

[wazuhtest]

I'm sure, since I'm working with apps installed on it. The API returned info, but when pipelining the command and grep for 'kvstore' there are no coincidences.

[chli_splunk]

How about remove "| grep kvstore"? Can you get some info?

[wazuhtest]

Yes, sorry about not mentioning it before. I obtain a lot of info, do you want to post the content here?

[chli_splunk]

Can you find "kvStoreStatus" field?

[wazuhtest]

Of course:
s:key name="kvStoreStatus">ready

[chli_splunk]

OK, it's not about KVStore then. Maybe we need more info about AoB version, logs or diags...

[wazuhtest]

AoB version: 2.2.0
I searched for information in /opt/splunk/var/log/splunk/splunk_app_addon-builder_ta_builder.log but I didn't find nothing about errors