Symptoms = My Content management page does not load / results in a blank page.
Recent changes = Following upgrade of Splunk Core from Splunk=6.3.x to Splunk=6.4.4, and while running Enterprise security ES=4.0.1.
What I've tried already = Upgrading to ES=4.0.5 as per supported platforms documentation here;
http://docs.splunk.com/Documentation/ES/4.0.1/RN/Enhancements
As per: https://answers.splunk.com/answers/474850/splunk-enterprise-security-how-to-resolve-error138.html
Present in ES=4.0.1-4.0.5 (Maybe other versions also).
Fixed in Newer versions (i.e. ES=4.2+ ES=4.5+).
Examples of Bug = Splunk Bug references SOLNESS-6255 and SOLNESS-11038.
The cause = The correlation_search.py web controller loads some helper code. This uses relative pathing, so depending on how the controller is executed we might not specify the intended directory.
The workaround:
Edit $SPLUNK_HOME/etc/apps/SA-ThreatIntelligence/appserver/controllers/correlation_searches.py:
from = sys.path.append( os.path.join("..", "..", "bin") )
to = sys.path.append(make_splunkhome_path(['etc', 'apps', 'SA-ThreatIntelligence', 'bin']))
The Fix:
Upgrade to ES=4.2+ or ES=4.5+
As per: https://answers.splunk.com/answers/474850/splunk-enterprise-security-how-to-resolve-error138.html
Present in ES=4.0.1-4.0.5 (Maybe other versions also).
Fixed in Newer versions (i.e. ES=4.2+ ES=4.5+).
Examples of Bug = Splunk Bug references SOLNESS-6255 and SOLNESS-11038.
The cause = The correlation_search.py web controller loads some helper code. This uses relative pathing, so depending on how the controller is executed we might not specify the intended directory.
The workaround:
Edit $SPLUNK_HOME/etc/apps/SA-ThreatIntelligence/appserver/controllers/correlation_searches.py:
from = sys.path.append( os.path.join("..", "..", "bin") )
to = sys.path.append(make_splunkhome_path(['etc', 'apps', 'SA-ThreatIntelligence', 'bin']))
The Fix:
Upgrade to ES=4.2+ or ES=4.5+