Modular input issue

[Karthikeya]

We are installing modular input (akamai add-on) to get akamai logs to Splunk.

In our environment, we have kept modular input in DS under deployment apps and pushed it to HF using serverclass. Is this the issue? Do modular inputs directly needs to be installed on HF rather than pushing from DS? 

Because we are configuring data input on HF (which is pushed frm DS) and when saving it is throwing 404 error action forbidden. When we directly install it on HF it is getting saved perfectly.

Almost in our environment all apps will be pushed from DS to CM and DS to Deployer even though they are not modular inputs contains just configs but as of now worked good.

Is it a bad practice in case of modular input?  Please guide me

[livehybrid]

Hi @Karthikeya 

Do you have a license installed on your HF?

I believe you need a license on your HF for this app to work because certain features are not enabled on the free license.

Please let me know how you get on and consider adding karma to this or any other answer if it has helped.
Regards

Will

[Karthikeya]

Yes license is there... 

[PickleRick]

As a rule of thumb, an add-on should work whether it's deployed locally or distributed from DS. There are some possible issues (some of which you can tackle successfully) coming from two possible issues:

1) When deployed from the DS, an app is being pushed as a whole. So - differently from deployer where you can configure push mode - you're deploying whole app overwriting local changes

2) There can be problems with pushing secrets with the app. If an app is made according to Splunk practices, the secrets should be either in plain text to be encrypted on first use or should be encrypted with the destination HF's secret (which raises issues when you want to distribute the same app across multiple HFs). If the app does secret storing its own way... well, you're on your own.

[Karthikeya]

@PickleRick https://splunkbase.splunk.com/app/4310

This is the app I have installed will It cause problem whiile pushing from DS to HF?

[PickleRick]

I've never tried this app so can't really tell.

In the description I see that it needs a working JRE installation on the HF machine so you have to fiddle with the server manually anyway. And the docs are not very good - they don't say which tier you have to install the app on, they assume you're installing the app using GUI; I suppose the author of the add-on has never seen any bigger than all-in-one installation of Splunk.

[Karthikeya]

@PickleRick have one query here... Do pushing app from DS to HF and configuring it in HF causing the problem? Our HF has Jre installed. When we install directly on HF and configuring it is working. What will be the consequences I may face in future if I install directly on HF rather than pushing it from DS? 

[PickleRick]

An app is just a directory with content so there should be no "technical" difference between a locally installed app and DS-distributed one. It's all about maintainability. I've seen environments where people would distribute pre-configured add-ons and I've seen places where half of the apps on HFs were standard and installed from DS but other half was installed locally.

[livehybrid]

Hi @Karthikeya 

Since you are able to make this work when installing directly on the HF then we should be able to rule out the JRE and Proxy configuration.

You've confirmed that you have a license on the HF so there shouldnt be any features disabled which might cause the issue. (And worked directly when installing on the HF).

I guess the next question is "what is different" - If it works when directly installing vs deploying DS then we need to work out what is different. How did you set it up on the HF? Did you copy all the files as they were on the HF and then drop them into deployment-apps on the DS?

Out of interest, were the client_id and client_secret encrypted in the inputs.conf on the HF? If so then as long as the encryption was done on the same HF then I wouldnt have expected an issue copying the encrypted value.

I think the key now is to work out what is different, I would get it working again on the HF then copy the files off. Deploy from the DS and then compare the difference between the files from the working installation vs DS installation.

Please let me know how you get on and consider adding karma to this or any other answer if it has helped.
Regards

Will