Security

Getting a "500 Internal Server Error" when navigating to Settings > Data Inputs (Licensed Version 7.3.1).

socrates4rufio
Explorer

Version 7.3.1 - Splunk Enterprise - Licensed

I receive a "500 Internal Server Error" when I try to navigate to Settings > Data Inputs. I've searched posted Answers with version 6.3. "splunk_httpinput app" is enabled; the other was to update to version 6.4.3. Neither provide resolution to the problem.

Didn't have any luck finding alternate methods to modify data inputs.

Thanks for the help.

0 Karma

PavelP
Motivator

Hello @socrates4rufio

do you see any errors in $SPLUNK_HOME/var/log/splunk/splunkd.log ?

0 Karma

socrates4rufio
Explorer

Hello @PaveIP

I did some further investigation:

When I use Chrome (64-bit) Ver 73.0... I receive a SSL3 alert - certificate unknown

When I use IE or Firefox; I still get the 500 Internal Error, but I don't get an error in splunkd.log

-- Thanks for the quick response

0 Karma

PavelP
Motivator

@socrates4rufio

  • is splunk running on windows or linux?
  • what happens if you click ignore/continue cert warning in Chrome? The same 500 Internal error?
  • can you post a full browser warning you get?
  • check also splunkd_access.log and splunkd_ui_access.log for 500 error and post the matching lines here
  • try to find any lines in splunkd.log matching the time when you navigating to Settings > Data Input
  • if not logged as admin - try to relogin as admin and test again. Do you get the same 500 error?
0 Karma

socrates4rufio
Explorer

Good Afternoon @PaveIP

I'm running Splunk Enterprise on a virtual Windows Server 2016.

The system is running in a standalone environment that's not connected to the internet - I'm not able to post a full browser image.

I checked the splunkd_access.log and the splunkd_ui_access.log:

"GET /en-US/splunkd/raw/servicesNS/nobody/splunk_instrumentation/instrumentation_controller/instrumentation_eligibility?optInVersion=3&=1591038782439 HTTP/1.1" 200 289 "-""Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.85 Safari/537.36" - <...> 1529ms

"GET /en-US/manager/launcher/datainputstats HTTP/1.1" 500 57504 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.85 Safari/537.36" - <...> 319ms

I've tried logging in as Admin and another Administrator account; as well as multiple web browsers. I enabled all TLS/SSL versions. Everything yields the same result.

0 Karma
Get Updates on the Splunk Community!

BSides Splunk 2022 - The Call for Papers is now Open!

TLDR; Main Site: https://bsidessplunk.com CFP Site: https://bsidessplunk.com/cfp CFP Opens: December 15th, ...

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...