All Apps and Add-ons

Why is website monitoring not working?

pa4rm
Path Finder

Since 12 day's website monitoring does not show any graph.
History data is still available. Uninstall and install app does not fix the problem.

I use it for 4 sites. I also added a site that is in the same subnet as my Splunk - no data shown.
Every time I open the app I get "No results found."
Using Splunk 7.3.3 and website monitor 2.8 version.

0 Karma
1 Solution

pa4rm
Path Finder

After some research I found the problem. The website monitoring app version 2.8 does not function correctly on Splunk with free license.
On the free licensed Splunk (7.3.3) I removed /opt/splunk/etc/apps/website_monitoring and /opt/splunk/etc/users/admin/website_monitoring and restarted Splunk. After restart website monitoring app 2.7.6 installed and configured. The data is collected and shown now.
This is for me acceptable workaround.

View solution in original post

0 Karma

pa4rm
Path Finder

This issue is not anymore present in version 2.9

0 Karma

pa4rm
Path Finder

@tobi2k this workaround is only for Splunk versions before 8.0.0.
I hope that @LukeMurphey will solve this bug it in the next release.

0 Karma

tobi2k
Explorer

I cannot confirm that workaround! Adding new Websites to Website Monitor once the Splunk Installation runs in Free-Mode, will not work. Reinstalling of the Plugin does not solve the issue!

Splunk: 8.01
Website-Monitoring Plugin: v2.9

0 Karma

pa4rm
Path Finder

@tobi2k it will work only on Splunk releases before 8.0.0. I hope that @LukeMurphey will solve this bug quickly in next release.

0 Karma

pa4rm
Path Finder

After some research I found the problem. The website monitoring app version 2.8 does not function correctly on Splunk with free license.
On the free licensed Splunk (7.3.3) I removed /opt/splunk/etc/apps/website_monitoring and /opt/splunk/etc/users/admin/website_monitoring and restarted Splunk. After restart website monitoring app 2.7.6 installed and configured. The data is collected and shown now.
This is for me acceptable workaround.

0 Karma

LukeMurphey
Champion

I'm going to fix this so that the app will continue to work on the free license: https://lukemurphey.net/issues/2538

0 Karma

pa4rm
Path Finder

@LukeMurphey I get same behavior using any website monitoring app on Splunk 8
So history is available, but the checks are not performed anymore on free licensed deployment.

0 Karma

pa4rm
Path Finder

Tnx Luke and thank you for great app.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @pa4rm,
to debug this problems you could start from two points of view:

  • logs continue to be generated on your targets and are in the same folder and format?
  • Universal Forwarder continues to send logs?

you can check the first condition on you target.
For the second you could try something like this

index=_internal host=your_host

and if there are Splunk internal logs and from that server you usually receive other logs

index=wineventlog (or another index used for your logs) host=your_host

If you don't receive any log, check the connection (from the target host telnet IP_indexer 9997) and the Universal Forwarder logs (at $SPLUNK_HOME/var/log/splunk/splunkd.log)

If you continue to receive other logs but not the ones you want, you have to check if it's changed something in the parsing, e.g. the time format of timestamp.

Ciao.
Giuseppe

0 Karma

pa4rm
Path Finder

Hi Giuseppe,

Thank you for your comment. I receive internal and external logs and they are processed correctly. I've only issues with website monitoring which was working fine for few years till 2 weeks ago.
When the problem occur, I didn't make any change or upgrade of systems.

Thanks

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @pa4rm,
if you're receiving logs from the same host we have to debug the input of those logs.
Please, check the grants on those files and, if possible share some example, your inputs.conf from Forwarder (the one related to those logs) and props.conf from Indexer containing the sourcetype definition of those logs.

Ciao.
Giuseppe

0 Karma

pa4rm
Path Finder

Hi Giuseppe,

permissions are ok. I tried to solve it by removing this app and installing again - no luck.

My local/inputs.conf

    [web_ping://RAD-IT]
    interval = 5m
    return_body = 0
    title = RAD-IT
    url = https://rad-it.nl
    user_agent = Splunk Website Monitoring (+https://splunkbase.splunk.com/app/1493/
    )

my default/inputs.conf

    [web_ping]
    user_agent=Splunk Website Monitoring (+https://splunkbase.splunk.com/app/1493/)

and my default/props.conf

    [source::...web_availability_modular_input.log]
    sourcetype=web_availability_modular_input

    [source::...website_monitoring_rest_handler.log]
    sourcetype=website_monitoring_rest_handler
0 Karma

LukeMurphey
Champion

Could you do some searching via the troubleshooting guide here: https://lukemurphey.net/projects/splunk-website-monitoring/wiki/Troubleshooting

I'll fix this ASAP if I can get some details that allow me to narrow down the problem.

0 Karma

pa4rm
Path Finder

Hi @LukeMurphey ,

On both search queries I get "No results found". Please view screenshots for proxy config (don't use it), python test and actual result page when I try to view monitoring results. Everiting was working fine till 2 weeks ago. I didn't make any change or upgrade at the time of starting problems.

alt text

alt text

alt text

0 Karma

pa4rm
Path Finder

Hi @LukeMurphy,

Just run again serach for modular input errors and got following:

        2019-12-07 23:36:39,374 ERROR Execution failed
        Traceback (most recent call last):
          File "/opt/splunk/etc/apps/website_monitoring/bin/modular_input.zip/modular_input/modular_input_base_class.py", line 1092, in execute
            self.do_run(in_stream, log_exception_and_continue=True)
          File "/opt/splunk/etc/apps/website_monitoring/bin/modular_input.zip/modular_input/modular_input_base_class.py", line 961, in do_run
            if ServerInfo.is_shc_captain(input_config.session_key) == False:
          File "/opt/splunk/etc/apps/website_monitoring/bin/modular_input.zip/modular_input/shortcuts.py", line 31, in wrapper
            return function(*args, **kwargs)
          File "/opt/splunk/etc/apps/website_monitoring/bin/modular_input.zip/modular_input/server_info.py", line 154, in is_shc_captain
            if not cls.is_on_shc(session_key):
          File "/opt/splunk/etc/apps/website_monitoring/bin/modular_input.zip/modular_input/shortcuts.py", line 31, in wrapper
            return function(*args, **kwargs)
          File "/opt/splunk/etc/apps/website_monitoring/bin/modular_input.zip/modular_input/server_info.py", line 111, in is_on_shc
            except splunk.ResourceNotFound:
        NameError: global name 'splunk' is not defined
0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...