Getting Python REST Error 404 while setting-up Splunk_TA_microsoft-cloudservices add-on

[sumedhjoglekar]

I have setup local splunk instance(8.2) and have installed add-on ' splunk add-on for microsoft cloud services'(4.1.3). I have already created eventhub and have added Azure Event Hubs Data Owner permission to my app in order to be able to access eventhub in azure. I am able to add azure app account in the configuration tab but while trying to add input, the splunk gui keeps on loading and am not able to add any inputs. When I checked the logs I found 404 errors. Below is a stack trace of the error.


06-28-2021 14:58:08.717 -0400 ERROR AdminManagerExternal [67673713 TcpChannelThread] - Stack trace from python handler:\nTraceback (most recent call last):\n File "/Applications/Splunk/etc/apps/Splunk_TA_microsoft-cloudservices/lib/splunktaucclib/rest_handler/handler.py", line 117, in wrapper\n for name, data, acl in meth(self, *args, **kwargs):\n File "/Applications/Splunk/etc/apps/Splunk_TA_microsoft-cloudservices/lib/splunktaucclib/rest_handler/handler.py", line 172, in all\n **query\n File "/Applications/Splunk/etc/apps/Splunk_TA_microsoft-cloudservices/lib/splunklib/binding.py", line 290, in wrapper\n return request_fun(self, *args, **kwargs)\n File "/Applications/Splunk/etc/apps/Splunk_TA_microsoft-cloudservices/lib/splunklib/binding.py", line 71, in new_f\n val = f(*args, **kwargs)\n File "/Applications/Splunk/etc/apps/Splunk_TA_microsoft-cloudservices/lib/splunklib/binding.py", line 686, in get\n response = self.http.get(path, all_headers, **query)\n File "/Applications/Splunk/etc/apps/Splunk_TA_microsoft-cloudservices/lib/splunklib/binding.py", line 1194, in get\n return self.request(url, { 'method': "GET", 'headers': headers })\n File "/Applications/Splunk/etc/apps/Splunk_TA_microsoft-cloudservices/lib/splunklib/binding.py", line 1255, in request\n raise HTTPError(response)\nsplunklib.binding.HTTPError: HTTP 404 Not Found -- b'{"messages":[{"type":"ERROR","text":"Not Found"}]}'\n\nDuring handling of the above exception, another exception occurred:\n\nTraceback (most recent call last):\n File "/Applications/Splunk/lib/python3.7/site-packages/splunk/admin.py", line 114, in init_persistent\n hand.execute(info)\n File "/Applications/Splunk/lib/python3.7/site-packages/splunk/admin.py", line 637, in execute\n if self.requestedAction == ACTION_LIST: self.handleList(confInfo)\n File "/Applications/Splunk/etc/apps/Splunk_TA_microsoft-cloudservices/bin/splunk_ta_mscs_rh_mscs_storage_table.py", line 111, in handleList\n AdminExternalHandler.handleList(self, confInfo)\n File "/Applications/Splunk/etc/apps/Splunk_TA_microsoft-cloudservices/lib/splunktaucclib/rest_handler/admin_external.py", line 51, in wrapper\n for entity in result:\n File "/Applications/Splunk/etc/apps/Splunk_TA_microsoft-cloudservices/lib/splunktaucclib/rest_handler/handler.py", line 122, in wrapper\n raise RestError(exc.status, str(exc))\nsplunktaucclib.rest_handler.error.RestError: REST Error [404]: Not Found -- HTTP 404 Not Found -- b'{"messages":[{"type":"ERROR","text":"Not Found"}]}'\n

Can someone please provide any suggestions on this ?

@jkat54 , @chli_splunk  , @bradp1234 , @tmontney 

[tmontney]

At the time, I thought this app was what I wanted due to confusingly similar app names. I no longer use this and ended up going with the Azure Add-on. If I remember correctly, this app failed even on a fresh instance of Splunk Enterprise. It's also rated quite poorly, it's likely it simply doesn't work.

From my brief time developing an app, that error is that an HTTP route doesn't exist. One of two things could be happening:

• The route doesn't exist. They made a typo in the handler script, web.conf, or restmap.conf.
• The route exists, but you're denied access.
  • I think Splunk supports this as you need to pass an authentication token. That token should be able to check what permissions you have and deny you appropriately.
  • The response did say Not Found, but sometimes servers will offer that instead of Unauthorized. The response first hits Splunk Web and, if no errors, proceeds to the handler. My guess is it doesn't make it to the handler, and Splunk Web responds with Not Found.

Unless someone else knows, it's likely you'll have to debug and fix the script yourself. However, if this is broken, I wonder what else is.