When I attempt to update my existing Apps/Add-Ons through my Search Head's GUI, I get a 500 Internet Server Error. When I tail the logs for the search head, I get this interesting python log:
2018-01-12 17:11:47,107 ERROR [HTTP 404] Resource not found
Traceback (most recent call last):
File "/opt/splunk/lib/python2.7/site-packages/splunk/rest/init.py", line 187, in dispatch
methodOutput = method()
File "/opt/splunk/etc/system/bin/appsmanager.py", line 218, in handle_GET
tree = etree.ElementTree(self._get_feed_root(url, extra_get_args=get_args))
File "/opt/splunk/etc/system/bin/appsmanager.py", line 395, in _get_feed_root
raise splunk.RESTException(404, "Resource not found")
RESTException: [HTTP 404] Resource not found
Has anyone seen this before? Is this is bug, or configuration error? This particular search head is accessing the Internet through a Squid web proxy, and all access is currently working (except this).
Try configuring below in
/opt/splunk/etc/system/local/web.conf. From web.conf.spec: make it
splunkdConnectionTimeout = <integer> * Number of seconds to wait before timing out when communicating with splunkd * Must be at least 30 * Values smaller than 30 will be ignored, resulting in the use of the default value * Defaults to 30
Let me know if this helps!
do you have http_proxy and https_proxy settings in your env variable pointing to your squid server? Also, do you have no_proxy setting in the env variable? if so, you need to adjust that to include local host