Splunk Dev

Getting configuration errors when installing modular input on heavy forwarder.

clorne
Communicator

Hello,

I am trying to install a modular input.
On a standalone Splunk, there is no problem, the setup dashboard shows up perfectly.

But on an heavy forwarder I get the following error on the graphical interface of Splunk:
Unable to initialize modular input "gmail_bigquery" defined inside the app "TA_AI_NR_1R93_gmail_HF": Introspecting scheme=gmail_bigquery: script running failed (exited with code 1).

And in the _internal index:

05-13-2019 15:21:53.237 +0200 ERROR
AdminManagerExternal - Stack trace
from python handler:\nTraceback (most
recent call last): \n File
"/opt/splunk/lib/python2.7/site-packages/splunk/admin.py",
line 130, in init\n

hand.execute(info)\n File
"/opt/splunk/lib/python2.7/site-packages/splunk/admin.py",
line 594, in execute\n if
self.requestedAction == ACTION_LIST:

self.handleList(confInfo)\n File
"/opt/splunk/etc/apps/TA_AI_NR_1R93_gmail_HF/bin/ta_ai_nr_1r93_gmail_hf/splunk_aoblib/rest_migration.py"spl
, line 38, in handleList\n

AdminExternalHandler.handleList(self,
confInfo)\n File
"/opt/splunk/etc/apps/TA_AI_NR_1R93_gmail_HF/bin/ta_ai_nr_1r93_gmail_hf/splunktaucclib/rest_handler/admin_external.py",
line 40, in wrapper\n for entity in
result:\n File
"/opt/splunk/etc/apps/TA_AI_NR_1R93_gmail_HF/bin/ta_ai_nr_1r93_gmail_hf/splunktaucclib/rest_handler/handler.py",
line 118, in wrapper\n raise
RestError(exc.status,
exc.message)\nRestError: REST Error
[404]: Not Found -- HTTP 404 Not Found
-- {"messages":[{"type":"ERROR","text":"Not
Found"}]}\n

It seems that something is missing in the configuration but I do not find what it could be ....

Cheers
Céline

Labels (2)
0 Karma

clorne
Communicator

Finally,
I use the command to debug the modular input:
./splunk cmd splunkd print-modinput-config --debug gmail .

This gave an other error message (different from what was logged into the _internals.

And I could correct this new error and then solved the issue

Get Updates on the Splunk Community!

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...

New This Month - SLO Capabilities, APM Advanced Filtering & Usage Analytics Plus ...

More for SLO Management We’re continuing to expand the built-in SLO management experience in Splunk ...

Enterprise Security Content Update (ESCU) | New Releases

In June, the Splunk Threat Research Team had 2 releases of new security content via the Enterprise Security ...