Getting Data In

Why am I getting different GUI pages from the same URL?

bkeif
Path Finder

I have two search heads (prod and QA).
On https://prod/en-US/manager/search/datainputstats I get the desired DataInputs page.
However, on https://QA/en-US/manager/search/datainputstats I get a different "Local Inputs" page.

Clicking on "add new" files & directories on Prod gives me the desired page to add data in with advanced options
whereas in QA it gives me this awful "AddData Wizard" which prevents me from accessing the options I want.

Why are there two different pages for the same URL on different boxes?

alt text

0 Karma
1 Solution

jkat54
SplunkTrust
SplunkTrust

You have different versions of splunk in each environment.

You also have dbconnect and other apps installed in QA but not in production

View solution in original post

0 Karma

jkat54
SplunkTrust
SplunkTrust

Hey our previous thread is over the limit on comments so I got yours via email but it's not shown here.

0 Karma

jkat54
SplunkTrust
SplunkTrust

You said this "That's incredible..There is indeed an app in Prod that seems to contain an entire old version of manager. I'd guess that you're right in that its overriding the default manager. Now I don't care how the "data input" page looks and I'd rather remove it so our search app can update. Is there a way to manually assign sourcetypes in the new "AddData" wizard?"

0 Karma

jkat54
SplunkTrust
SplunkTrust

To answer that yes you create sourcetypes on the 2nd or 3rd step in the add data wizard. I think you upload in first step, then select sourcetype in 2nd. They give you the list of predefined sourcetypes to select from and then if you modify the settings any it asks you to save as a new sourcetype or not. If you dot save it, it will apply only to your upload, if you do save it, it usually falls into the "custom" category for use later. Can you mark my other answer as the answer please?

0 Karma

somesoni2
Revered Legend

Could you compare the version of Splunk on those two box? Go to Top left menu->Help->About.

0 Karma

bkeif
Path Finder

Both are 6.3.1
build: f3e41e4b37b2

0 Karma

jkat54
SplunkTrust
SplunkTrust

You have different versions of splunk in each environment.

You also have dbconnect and other apps installed in QA but not in production

View solution in original post

0 Karma

bkeif
Path Finder

Both splunk instances are 6.3.1 and dbconnect is installed on both.

0 Karma

jkat54
SplunkTrust
SplunkTrust

Then you didnt completely upgrade production to 6.3.1. Apparently the manager directory under the search app stayed the same. I'd check file permissions in production to be sure the appropriate user owns everything in the splunk dir, and then redeploy 6.3.1.

0 Karma

jkat54
SplunkTrust
SplunkTrust

C:\Program Files\Splunk\etc\apps\search\default\data\ui\manager for example

0 Karma

bkeif
Path Finder

Permissions are correct for that dir.
Another weird observation...although the url for DataInputs is the same, after I click on "Add New" prod goes to /en-US/manager/search/data/inputs/monitor/_new?action=edit but QA goes to /en-US/manager/launcher/adddata/selectsource?input_mode=1&input_type=file_monitor

if I simply copy the prod link to QA I can reach the page I want however that does not help me solve the underlying issue.

0 Karma

jkat54
SplunkTrust
SplunkTrust

compare the files under Splunk\etc\apps\search\default\data\ui\manager in both environments.

0 Karma

bkeif
Path Finder

a diff between both dirs reveals that they contain the same files and the files' contents are identical

0 Karma

jkat54
SplunkTrust
SplunkTrust

If this is true then the only other explanation is proxy/edge caching. Try pressing CTRL+F5 when you have production open in a browser.

0 Karma

bkeif
Path Finder

no good. I think it must be configurable somewhere because these servers are not newly upgraded and either way production exhibits the desired behavior. I want QA to behave the same way as prod not the other way around.

0 Karma

jkat54
SplunkTrust
SplunkTrust

its configurable by file system modifications...

aka, if you copy in the search app from an older copy of splunk which is what I think has happened already. These pages are being driven by code found the mrsparkle directory as well as the manager folder we've already discussed.

I recommend a full diff between Prod and QA, but I dont recommend downgrading QA to match production. Instead I'd go the other way around because the newer documentation has these newer screenshots etc.

0 Karma

jkat54
SplunkTrust
SplunkTrust

At this point I assume you have another app in production that someone created using a copy of the search app. Perhaps they didnt know the implications of doing so. But it's manager UI folder may be overriding the one found in your search app, etc. This is why both URL work in production... both sets of code are present.

Check your other app folders for these folders default\data\ui\manager or local\data\ui\manager.

If you really want QA to act the same, copy the app you find thats overriding this to QA. Again i recommend against this as it is not a best practice and is certainly unsupported.

0 Karma

bkeif
Path Finder

That's incredible..There is indeed an app in Prod that seems to contain an entire old version of manager. I'd guess that you're right in that its overriding the default manager. Now I don't care how the "data input" page looks and I'd rather remove it so our search app can update. Is there a way to manually assign sourcetypes in the new "AddData" wizard?

0 Karma

bkeif
Path Finder

That's incredible..there is indeed an app on Prod that seems to contain an entire old version of the manager. I would guess that you are right in that it is overriding the new version. Now I don't really care how the "data inputs" page looks and I'd rather remove it so our search app can update. Is it possible to manually assign sourcetypes using the new "AddData" Wizard?

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!