Common Information Model (CIM) Data Model Editor misbehaviour and broken error reporting

[DUThibault]

I've got a standalone Splunk 7.0.0 instance with data fed by a forwarder (monitoring /var/log on the forwarder's system). Following http://docs.splunk.com/Documentation/CIM/4.9.1/User/Howtousethesereferencetables, I open "Settings: (Knowledge) Data models" (the Data Model Editor) and then click on the JVM data model. I get a nasty 404 error:

404 Not Found

[Return to Splunk home page]
Page not found! [View more information about your request (request ID = 5a1dc2d0597fbc90442e50) in Search]

You are logged into ###.###.###.###:8000 as admin, which is connected to splunkd @############ at https://###.###.###.###:8089 on Tue Nov 28 15:10:56 2017.

That by itself is not something that should happen, right? But it gets better! If I click "View more information..." to try to get details about the error, a Search page comes up...with no hits. The search is:

index=_internal host="dsu_01" source=*web_service.log log_level=ERROR requestid=5a1dc2d0597fbc90442e50
No results found.

Which is particularly odd. /opt/splunk/var/log/splunk/web_service.log exists and does contain two entries (see below) for the error ID in question. Is Splunk's introspection incorrectly set up?

2017-11-28 15:10:56,464 WARNING [5a1dc2d0597fbc90442e50] view:165 - Splunk cannot load app "Splunk_SA_CIM" because it could not find a related app.conf file.
2017-11-28 15:10:56,465 INFO [5a1dc2d0597fbc90442e50] error:133 - Masking the original 404 message: 'App "Splunk_SA_CIM" does not support direct UI access. ' with 'Page not found!' for security reasons

This happens with every single one of the 23 Data Models. Now, if one is not supposed to be able to click the Data Model names at all, why is the Data Model Editor displaying links? Presumably one is supposed to just unfold the Data Model line using the ">" in the leftmost column, which does work.

[esmat777]

From Apps > choose Manage Apps > search for Splunk CIM

From Actions > Edit properties then Visible choose (Yes)

CIM-Addon : will work normally

[smoir_splunk · Accepted solution]

After some investigation, this is likely because you're going to Settings > Data Models > Data Model Editor from the CIM Setup page. Because CIM is a non-visible app, this breaks. I filed SPL-146820 to address this as a bug.

For now, if you start in the Search and Reporting app, then go to Settings > Data Models and click a data model, everything should work fine with no 404.

[sandeepduppalli]

You are right I also experienced the same . Thankyou for your input

[DUThibault]

What makes this bug particularly sneaky is that regardless of where you reached the Data Model Editor page from, the "Apps >" menu reverts to "Apps >" so you can't tell whether or not it'll be broken.

[DUThibault]

The Edit Datasets menu and the Pivot and (Datasets) Edit buttons are just as broken. The only things editable are permissions, acceleration, and description. It seems impossible to get something like:

[smoir_splunk]

@DUThibault, is the CIM app installed? In addition, did you clear your cache after upgrading to the new version of CIM? A lot of changes were made to the setup page, so I wonder if that is what is happening.

[smoir_splunk]

I realized that my comment assumed you were running 4.9.1. If you're running version 4.9.0, you will need to upgrade to version 4.9.1, this is a known issue in 4.9.0 (CIM-575) (that the setup page is not accessible).

[DUThibault]

Nope, 4.8.0 upgraded to 4.9.1. How does one clear the Splunk cache?

[smoir_splunk]

@DUThibault

You can clear the splunk cache this way:
http:///en-US/_bump

And you can also try clearing the browser cache and/or trying an incognito window. If the issue persists, I would suggest working with Splunk Support to see if it's a bug that you've run into.

[DUThibault]

Bumping the cache fixed the Data Model editing problem. Thanks!

This leaves the second layer, the error reporting problem ---assuming it's still there. But there is no easy way to test that, is there?

Oops, spoke too soon! I've found out that bumping is not the solution...The problem apparently has to do with the App selected in the Apps menu when you visit the Data Model editor. Consider these two URLs:

https://192.168.1.170:8000/en-US/manager/Splunk_SA_CIM/data_model_manager?sortKey=displayName&sortDi...
https://192.168.1.170:8000/en-US/manager/MyFirstApp/data_model_manager?sortKey=displayName&sortDirec...

In the first, clicking a data model fails as documented earlier. In the second, the various links work just fine. It does not have to be a custom app like MyFirstApp, Search or gettingstarted, etc., will also work. It seems only the Splunk_SA_CIM triggers the bug. And one of the only ways you can get there is if you are in the CIM Setup page and then choose "Settings: (Knowledge) Data models". I'll file a bug.

[smoir_splunk]

Yes, that certainly sounds like a bug. Thanks for your patience in walking through some triage steps with me!

[DUThibault]

Looks like our license and support renewal has not gone through yet, so I can't file a bug. Maybe you could do so on my behalf?

[smoir_splunk]

I only have the ability to file a bug with engineering, but we'd need more triage to be done and details gathered by support before working a bug at that level, unfortunately. However, I'll see what I can sort out.