Deployment Architecture

Example setup.xml failure

phoenixdigital
Builder

I just tried to test the example provided at
http://www.splunk.com/base/Documentation/4.2.1/Developer/SetupExample1

I created the myapp/default/savedsearches.conf with the contents
then added the input to the myapp/defaut/inputs.conf. Finally created the myapp/default/setup.xml EXACTLY as mentioned.

All I got was this when prompted to view setup

404 Not Found

Splunk cannot find "apps/local/myapp/setup".

This page was linked to from http://192.168.0.200:8000/en-US/app/myapp.

You are using 192.168.0.200:8000, which is connected to splunkd @98164 at https://127.0.0.1:8089 on Tue Aug 9 16:36:04 2011.

I find it a bit odd that such a simple example provided on the splunk website would fail like this?

I am running Splunk on windows if that makes any difference.

Tags (2)
1 Solution

phoenixdigital
Builder

I found the issue by looking in splunkd.log

It was this line from the setup.xml

'WebSearch' should be 'Web Search'

I highly recommend someone update the public website. While its a simple mistake it is incredibly frustrating trying to use documented demos which dont work. Then trying to debug something you are learning at the same time.

View solution in original post

gaurav_maniar
Builder

I'm facing similar kind of issue and not able to find any solution.I have followed all the given instructions and prepared the following conf files.

setup.xml

<setup>
    <block title="User Dashboard Configuration" endpoint="userinput/user_input" entity="dashboard_conf">
        <input field="dashboard_url">
            <label>Dashboard URL</label>
            <type>text</type>
        </input>
        <input field="auth_token">
            <label>Authentication Token</label>
            <type>text</type>
        </input>
    </block>
    <block title="Syslog Configuration" endpoint="userinput/user_input" entity="syslog_conf">
        <input field="slog_port">
            <label>Syslog Port</label>
            <type>text</type>
        </input>
    </block>
</setup>

restmap.conf

[admin:user_input]
match=/userinput
members=user_input

[admin_external:user_input]
handlertype = python
handlerfile = user_input_setup.py
handleractions = list, edit

user_input.conf

[dashboard_conf]
dashboard_url = https://
auth_token = 

[syslog_conf]
slog_port = 

While I try to open the setup page from Manage Apps -> Set Up, it gives me 404 page not found error (web_service.log). I dont know what I'm missing here. It is not even opening setup page dialog box.

INFO [58eaa49e4d11014cc90] error:138 - Masking the original 404 message: 'Nothing matches the given URI' with 'Page not found!' for security reasons
0 Karma

phoenixdigital
Builder

setup.xml pages are incredibly finicky and the _internal logs are almost barren with information about why they fail.

My only recommendation would be to start with a known working example then gradually change it piece by piece testing with every change until it is configured how you want it.

From your example verify that the endpoint exists on your Splunk instance. That is the only suspect thing I can see in your example above.

https://yourSplunkServerIP:8089/services/userinput/user_input

Normally they would be located somewhere like here
https://yourSplunkServerIP:8089/services/admin/myCustomApiSettingsEndpoint

<setup>
  <block title="Proxy Server Details" endpoint="admin/myCustomApiSettingsEndpoint" entity="web_proxy">
    <input field="proxy_address">
      <label>Proxy Address</label>
      <type>text</type>
    </input>
    <input field="proxy_username">
      <label>Proxy Username</label>
      <type>text</type>
    </input>
    <input field="proxy_password">
      <label>Proxy password</label>
      <type>text</type>
    </input>
    <text>This password will be encrypted in Splunk's password store. If left blank the password will remain unchanged.</text>
  </block>

  <block title="Warning">
    <text>If you change the username you will need to reenter the password as it is stored internally against the username.</text>
    <text>Please be patient and wait for this form to complete before navigating away from this page.</text>
  </block>
</setup>
0 Karma

gaurav_maniar
Builder

I checked some applications from Splunk base, and having same configuration and still works. Splunk base apps don't have any admin endpoint.

0 Karma

phoenixdigital
Builder

Fair enough. Which apps so I can have a look too?

Like I said nothing stands out as wrong with your config. Without more details from Splunk logs the only logical way to resolve is to start with a working demo config and change one thing at a time testing each change until you get to where you want.

It shouldn't take more than an hour to do that so it is worth a try.

At one point you will find the bit that breaks. Then please post here so we can all learn from it.

0 Karma

gaurav_maniar
Builder

symantec_atp_app and Splunk_TA_Okta

0 Karma

araitz
Splunk Employee
Splunk Employee

Sorry, fixed now - thanks for bringing it to our attention. I understand your frustration.

0 Karma

carasso
Splunk Employee
Splunk Employee

Docs and error system could also be more clear that the setup.xml blocks must be wrapped in " ... "
they don't say that or show that in their examples.

0 Karma

phoenixdigital
Builder

I found the issue by looking in splunkd.log

It was this line from the setup.xml

'WebSearch' should be 'Web Search'

I highly recommend someone update the public website. While its a simple mistake it is incredibly frustrating trying to use documented demos which dont work. Then trying to debug something you are learning at the same time.

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...