Reporting

Getting error after installing a App

CamBam
New Member

I just installed the Splunk for Palo Alto Network apps. I created a folder under c:\program files\Splunk\etc\apps\PAN. Created a default and local folder, placing the following files

props.conf savedsearches.conf transform.conf fields.conf

Now I can see the app and the reports in splunk, but am getting the following error when I try to run the reports.

TypeError: 'NoneType' object is unsubscriptable.

What Am I missing?

Tags (1)
0 Karma

jrodman
Splunk Employee
Splunk Employee

This is unexpected, and more of a troubleshooting problem than fits neatly in splunk answers.

It could be one of several underlying issues, including permissions. If you installed the app yourself, be sure the splunk user has access to the files that the app installed as.

The specific error you're seeing is a splunkweb fail of some kind. The web_service.log may have a useful exception which helps clarify.

The root problem is often being encountered by splunkd, however, and passed back up to splunkweb. splunkd.log may be full of interesting comments.

This app was built for 3.x, and may need some tweaking for 4.x. Consider lifing the search directly out of the savedsearches.conf and see what you get there, for starters.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...