I've got a standalone Splunk 7.0.0 instance with data fed by a forwarder (monitoring
/var/log on the forwarder's system). Following
http://docs.splunk.com/Documentation/CIM/4.9.1/User/Howtousethesereferencetables, I open "Settings: (Knowledge) Data models" (the Data Model Editor) and then click on the JVM data model. I get a nasty 404 error:
404 Not Found
[Return to Splunk home page]
Page not found! [View more information about your request (request ID = 5a1dc2d0597fbc90442e50) in Search]
You are logged into ###.###.###.###:8000 as admin, which is connected to splunkd @############ at https://###.###.###.###:8089 on Tue Nov 28 15:10:56 2017.
That by itself is not something that should happen, right? But it gets better! If I click "View more information..." to try to get details about the error, a Search page comes up...with no hits. The search is:
index=internal host="dsu01" source=*webservice.log loglevel=ERROR requestid=5a1dc2d0597fbc90442e50
No results found.
Which is particularly odd.
/opt/splunk/var/log/splunk/web_service.log exists and does contain two entries (see below) for the error ID in question. Is Splunk's introspection incorrectly set up?
2017-11-28 15:10:56,464 WARNING [5a1dc2d0597fbc90442e50] view:165 - Splunk cannot load app "SplunkSACIM" because it could not find a related app.conf file.
2017-11-28 15:10:56,465 INFO [5a1dc2d0597fbc90442e50] error:133 - Masking the original 404 message: 'App "SplunkSACIM" does not support direct UI access. ' with 'Page not found!' for security reasons
This happens with every single one of the 23 Data Models. Now, if one is not supposed to be able to click the Data Model names at all, why is the Data Model Editor displaying links? Presumably one is supposed to just unfold the Data Model line using the ">" in the leftmost column, which does work.
Edit Datasets menu and the
Pivot and (Datasets)
Edit buttons are just as broken. The only things editable are permissions, acceleration, and description. It seems impossible to get something like:
@DUThibault, is the CIM app installed? In addition, did you clear your cache after upgrading to the new version of CIM? A lot of changes were made to the setup page, so I wonder if that is what is happening.
I realized that my comment assumed you were running 4.9.1. If you're running version 4.9.0, you will need to upgrade to version 4.9.1, this is a known issue in 4.9.0 (CIM-575) (that the setup page is not accessible).
Nope, 4.8.0 upgraded to 4.9.1. How does one clear the Splunk cache?
You can clear the splunk cache this way:
And you can also try clearing the browser cache and/or trying an incognito window. If the issue persists, I would suggest working with Splunk Support to see if it's a bug that you've run into.
Bumping the cache fixed the Data Model editing problem. Thanks!
This leaves the second layer, the error reporting problem ---assuming it's still there. But there is no easy way to test that, is there?
Oops, spoke too soon! I've found out that bumping is not the solution...The problem apparently has to do with the App selected in the Apps menu when you visit the Data Model editor. Consider these two URLs:
In the first, clicking a data model fails as documented earlier. In the second, the various links work just fine. It does not have to be a custom app like MyFirstApp, Search or gettingstarted, etc., will also work. It seems only the SplunkSACIM triggers the bug. And one of the only ways you can get there is if you are in the CIM Setup page and then choose "Settings: (Knowledge) Data models". I'll file a bug.
Yes, that certainly sounds like a bug. Thanks for your patience in walking through some triage steps with me!
Looks like our license and support renewal has not gone through yet, so I can't file a bug. Maybe you could do so on my behalf?
I only have the ability to file a bug with engineering, but we'd need more triage to be done and details gathered by support before working a bug at that level, unfortunately. However, I'll see what I can sort out.