Why can't the Splunk App for Stream capture any data from the stream when REST API Modular Input is running?

[bayuadhi]

I just installed App for Stream and REST API. The thing is when both of them are running, the App for Stream can't get any data from the stream. But if I kill the rest.py script, the stream is captured. Any idea how to resolve this? My temporary solution is to install 2 instances of Splunk, one for App for Stream and the other one for REST API.

[mbrahmkshatriya]

Hello Bayuadhi,

Was just wondering did your issue got resolved ? I have been trying to recreate the similar scenario, but it is actually working fine under my setup. I have REST API and Streamfwd both running under the same instance of Splunk without any conflict.

Is there any specific rest api call that you are using, which if you would like to share then I can try it out.

[Damien_Dallimor]

Do you have any log messages to go off for diagnosis here ?

[bayuadhi]

when i check all log related with stream there is no problem at all. however app for stream still stop capturing. then i check all running process, i found rest.py process. i kill rest.py process -> restart server -> app for stream start capturing.

[Damien_Dallimor]

And can you replicate this with other Modular Inputs or Scripted Inputs that perform network operations ? Stream and Rest are 2 entirely seperate Apps , they don't directly interact in any way at all. Perhaps it is down to something in the inner workings of Stream at the network interface layer ?

[csharp_splunk]

Yeah, not ruling out this is actually happening, but I'm a little dubious as to the diagnosis. Please open a case with support, this shouldn't be happening and in order to diagnose it we probably need a diag.

[bayuadhi]

actually I already get support from Splunk APAC, but they haven't resolved this either..