Dashboards & Visualizations

Create a custom Splunk view Tutorial not working

smhsplunk
Communicator

Hello

I am trying to run this tutorial from http://dev.splunk.com/view/SP-CAAAERG

When I try to hit refresh (/debug/refresh) I get this and also, I do not see "Hello World" once I go to the dashboard page. It shows the dashboard empty.

Refreshing admin/collections-conf          BadRequest 
In handler 'collections-conf': Must use user context of 'nobody' when interacting with collection configurations (used user='admin')

Can you tell me how to fix this ?

Tags (3)
0 Karma

jcrabb_splunk
Splunk Employee
Splunk Employee

The debug/refresh endpoint will reload configs that are available under /servicesNS/admin/search/admin endpoint. Under the admin endpoint, we have collection-conf endpoint which does provide _reload option, thus it would throw the following type of error.

In handler 'collections-conf': Must use user context of 'nobody' when interacting with collection configurations (used user='admin')

This collections-conf issue/error has now been addressed in the following releases:

- Splunk 6.2.8 - (bug: SPL-107404)
- Splunk 6.3.4 - (bug: SPL-111358)
- Splunk 6.4.0 - (bug: SPL-111360)

Jacob
Sr. Technical Support Engineer
0 Karma

smhsplunk
Communicator

I have restarted splunk both from the web interface and also manually form \bin, still doesnt show.
Even tried disabling enabling app.

0 Karma

somesoni2
Revered Legend

Try restarting your splunk instance instead.

0 Karma

smhsplunk
Communicator

When I hit refresh these are the three BadRequest I get, rest shows OK

Refreshing admin/collections-conf BadRequest
In handler 'collections-conf': Must use user context of 'nobody' when interacting with collection configurations (used user='admin')

Refreshing admin/remote_indexes BadRequest
In handler 'remote_indexes': The following required arguments are missing: repositoryLocation.

Refreshing admin/transforms-reload ResourceNotFound
In handler 'transforms-reload': Invalid action for this internal handler (handler: transforms-reload, supported: list|_reload, wanted: list).

0 Karma
Get Updates on the Splunk Community!

The OpenTelemetry Certified Associate (OTCA) Exam

What’s this OTCA exam? The Linux Foundation offers the OpenTelemetry Certified Associate (OTCA) credential to ...

From Manual to Agentic: Level Up Your SOC at Cisco Live

Welcome to the Era of the Agentic SOC   Are you tired of being a manual alert responder? The security ...

Splunk Classroom Chronicles: Training Tales and Testimonials (Episode 4)

Welcome back to Splunk Classroom Chronicles, our ongoing series where we shine a light on what really happens ...