Akamai add-on logs are not populating.

[Karthikeya]

We have installed Akamai add-on (https://splunkbase.splunk.com/app/4310) on our HF and installed Java and configured data input in HF by creating index in HF just for dropdown purpose and create the same index in CM and pushed to indexers. But we are not receiving any data now. 

When we are checking in splunkd.log below:

04-02-2025 11:08:27.529 +0000 INFO ExecProcessor [8927 ExecProcessor] - message from "/opt/splunk/etc/apps/TA-Akamai_SIEM/linux_x86_64/bin/TA-Akamai_SIEM.sh" infoMsg = streamEvents, begin streamEvents
04-02-2025 11:08:27.646 +0000 INFO ExecProcessor [8927 ExecProcessor] - message from "/opt/splunk/etc/apps/TA-Akamai_SIEM/linux_x86_64/bin/TA-Akamai_SIEM.sh" infoMsg = streamEvents, inputName=TA-Akamai_SIEM://WAF_AKAMAI_SIEM_DEV
04-02-2025 11:08:27.646 +0000 INFO ExecProcessor [8927 ExecProcessor] - message from "/opt/splunk/etc/apps/TA-Akamai_SIEM/linux_x86_64/bin/TA-Akamai_SIEM.sh" infoMsg = streamEvents, inputName(String)=TA-Akamai_SIEM://WAF_AKAMAI_SIEM_DEV
04-02-2025 11:08:27.653 +0000 INFO ExecProcessor [8927 ExecProcessor] - message from "/opt/splunk/etc/apps/TA-Akamai_SIEM/linux_x86_64/bin/TA-Akamai_SIEM.sh" infoMsg streamEvents Service connect to Akamai_SIEM App...
04-02-2025 11:08:27.900 +0000 INFO ExecProcessor [8927 ExecProcessor] - message from "/opt/splunk/etc/apps/TA-Akamai_SIEM/linux_x86_64/bin/TA-Akamai_SIEM.sh" infoMsg=Processing Data...
04-02-2025 11:08:27.900 +0000 INFO ExecProcessor [8927 ExecProcessor] - message from "/opt/splunk/etc/apps/TA-Akamai_SIEM/linux_x86_64/bin/TA-Akamai_SIEM.sh" infoMsg=KV Service get...
04-02-2025 11:08:27.902 +0000 INFO ExecProcessor [8927 ExecProcessor] - message from "/opt/splunk/etc/apps/TA-Akamai_SIEM/linux_x86_64/bin/TA-Akamai_SIEM.sh" infoMsg=Parse KVstore data...
04-02-2025 11:08:27.946 +0000 INFO ExecProcessor [8927 ExecProcessor] - message from "/opt/splunk/etc/apps/TA-Akamai_SIEM/linux_x86_64/bin/TA-Akamai_SIEM.sh" infoMsg=Parse KVstore data...Complete
04-02-2025 11:08:27.946 +0000 INFO ExecProcessor [8927 ExecProcessor] - message from "/opt/splunk/etc/apps/TA-Akamai_SIEM/linux_x86_64/bin/TA-Akamai_SIEM.sh" urlToRequest=https://akab-hg3zdmaay4bq4n5w-ljwg5vtmjxs5ukg2.luna.akamaiapis.net/siem/v1/configs/108115;107918?off...
04-02-2025 11:08:28.820 +0000 INFO ExecProcessor [8927 ExecProcessor] - message from "/opt/splunk/etc/apps/TA-Akamai_SIEM/linux_x86_64/bin/TA-Akamai_SIEM.sh" status code=200
04-02-2025 11:08:28.822 +0000 INFO ExecProcessor [8927 ExecProcessor] - message from "/opt/splunk/etc/apps/TA-Akamai_SIEM/linux_x86_64/bin/TA-Akamai_SIEM.sh" awaiting shutdown...
04-02-2025 11:08:28.850 +0000 INFO ExecProcessor [8927 ExecProcessor] - message from "/opt/splunk/etc/apps/TA-Akamai_SIEM/linux_x86_64/bin/TA-Akamai_SIEM.sh" found new offset: fd2ba;-kKV2wsV1oLesFFgkhv-dUAfVlC09trNuJWPKUOI8wCVnPWtwMjhld_MIgN84uv9OcFL6Fq5EwOs-wwKHLC1hUDvjBAhG7ZeROQ4kxLcdDwYSFhmF_iTYqmW8EE26VWd9cW1
04-02-2025 11:08:28.851 +0000 INFO ExecProcessor [8927 ExecProcessor] - message from "/opt/splunk/etc/apps/TA-Akamai_SIEM/linux_x86_64/bin/TA-Akamai_SIEM.sh" termination complete....
04-02-2025 11:08:28.851 +0000 INFO ExecProcessor [8927 ExecProcessor] - message from "/opt/splunk/etc/apps/TA-Akamai_SIEM/linux_x86_64/bin/TA-Akamai_SIEM.sh" Cores: 8
04-02-2025 11:08:28.851 +0000 INFO ExecProcessor [8927 ExecProcessor] - message from "/opt/splunk/etc/apps/TA-Akamai_SIEM/linux_x86_64/bin/TA-Akamai_SIEM.sh" Consumer CPU time: 0.03 s
04-02-2025 11:08:28.851 +0000 INFO ExecProcessor [8927 ExecProcessor] - message from "/opt/splunk/etc/apps/TA-Akamai_SIEM/linux_x86_64/bin/TA-Akamai_SIEM.sh" EdgeGrid time: 0.88 s
04-02-2025 11:08:28.852 +0000 INFO ExecProcessor [8927 ExecProcessor] - message from "/opt/splunk/etc/apps/TA-Akamai_SIEM/linux_x86_64/bin/TA-Akamai_SIEM.sh" Real time: 1.21 s
04-02-2025 11:08:28.852 +0000 INFO ExecProcessor [8927 ExecProcessor] - message from "/opt/splunk/etc/apps/TA-Akamai_SIEM/linux_x86_64/bin/TA-Akamai_SIEM.sh" Consumer CPU utilization: 14.15%
04-02-2025 11:08:28.852 +0000 INFO ExecProcessor [8927 ExecProcessor] - message from "/opt/splunk/etc/apps/TA-Akamai_SIEM/linux_x86_64/bin/TA-Akamai_SIEM.sh" Lines Processed: 1
04-02-2025 11:08:28.852 +0000 INFO ExecProcessor [8927 ExecProcessor] - message from "/opt/splunk/etc/apps/TA-Akamai_SIEM/linux_x86_64/bin/TA-Akamai_SIEM.sh" infoMsg=KV Service get...
04-02-2025 11:08:28.854 +0000 INFO ExecProcessor [8927 ExecProcessor] - message from "/opt/splunk/etc/apps/TA-Akamai_SIEM/linux_x86_64/bin/TA-Akamai_SIEM.sh" infoMsg=Parse KVstore data...
04-02-2025 11:08:28.855 +0000 INFO ExecProcessor [8927 ExecProcessor] - message from "/opt/splunk/etc/apps/TA-Akamai_SIEM/linux_x86_64/bin/TA-Akamai_SIEM.sh" infoMsg=Parse KVstore data...Complete
04-02-2025 11:08:28.870 +0000 INFO ExecProcessor [8927 ExecProcessor] - message from "/opt/splunk/etc/apps/TA-Akamai_SIEM/linux_x86_64/bin/TA-Akamai_SIEM.sh" infoMsg = streamEvents, end streamEvents
04-02-2025 11:08:28.870 +0000 ERROR ExecProcessor [8927 ExecProcessor] - message from "/opt/splunk/etc/apps/TA-Akamai_SIEM/linux_x86_64/bin/TA-Akamai_SIEM.sh" javax.xml.stream.XMLStreamException: No element was found to write: java.lang.ArrayIndexOutOfBoundsException: -1

Not sure what are these errors are but when we are checking with index=<created index> in SH no data is showing. Please help me in this case.

Even installed this add-on in deployer by removing inputs.conf and pushed to SHs as it has props and transforms to be performed at search time.

[k_sam]

I can confirm @dural_yyz observation.

In our case as well this was not an error just weird logging telling you, connection successful but nothing to read.

Try reducing frequency of your query or ignore this.

[dural_yyz]

04-02-2025 11:08:28.852 +0000 INFO ExecProcessor [8927 ExecProcessor] - message from "/opt/splunk/etc/apps/TA-Akamai_SIEM/linux_x86_64/bin/TA-Akamai_SIEM.sh" Lines Processed: 1

It appears to me that it made a successful connection and request for data download, but that download was empty.  I'm not an Akamai expert but perhaps you are requesting the wrong account/category of logs so revalidate the input config on the HF.

All the logs are INFO or higher so no DEBUG level logs.  You could potentially change logging levels from INFO to DEBUG in order to catch additional details about the connection and request that could be helpful.