I've got a standalone Splunk 7.0.0 instance with data fed by a forwarder (monitoring /var/log on the forwarder's system). Following http://docs.splunk.com/Documentation/CIM/4.9.1/User/Howtousethesereferencetables, I open "Settings: (Knowledge) Data models" (the Data Model Editor) and then click on the JVM data model. I get a nasty 404 error:
404 Not Found
[Return to Splunk home page]
Page not found! [View more information about your request (request ID = 5a1dc2d0597fbc90442e50) in Search]
You are logged into ###.###.###.###:8000 as admin, which is connected to splunkd @############ at https://###.###.###.###:8089 on Tue Nov 28 15:10:56 2017.
That by itself is not something that should happen, right? But it gets better! If I click "View more information..." to try to get details about the error, a Search page comes up...with no hits. The search is:
index=_internal host="dsu_01" source=*web_service.log log_level=ERROR requestid=5a1dc2d0597fbc90442e50
No results found.
Which is particularly odd. /opt/splunk/var/log/splunk/web_service.log exists and does contain two entries (see below) for the error ID in question. Is Splunk's introspection incorrectly set up?
2017-11-28 15:10:56,464 WARNING [5a1dc2d0597fbc90442e50] view:165 - Splunk cannot load app "Splunk_SA_CIM" because it could not find a related app.conf file.
2017-11-28 15:10:56,465 INFO [5a1dc2d0597fbc90442e50] error:133 - Masking the original 404 message: 'App "Splunk_SA_CIM" does not support direct UI access. ' with 'Page not found!' for security reasons
This happens with every single one of the 23 Data Models. Now, if one is not supposed to be able to click the Data Model names at all, why is the Data Model Editor displaying links? Presumably one is supposed to just unfold the Data Model line using the ">" in the leftmost column, which does work.
