Splunk Add on not working after being pushed by deployment server

[kaboom1]

Hello all,

I installed a Splunk add-on on my heavy forwarder just to test it first, it worked fine.

After that I copied it (the entire directory) to the deployment server and I pushed it to the heavy forwarder because, you know, I want to manage everything from the deployment server (trying to be organized 😅)

The issue is, from the heavy forwarder GUI, when i click on the app icon it doesn't load: it gives me "500 Internal Server Error" (with the picture of the confused horse 😂)

and I have these error messages from the internal logs: 

"ERROR ExecProcessor [2341192 ExecProcessorSchedulerThread] - message from "/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/myapp_hf/bin/app.py" HTTP 404 Not Found -- Action forbidden."

I forgot to mention that I changed the name of the original app in app.conf 😅

I can't figure out why it is not working 😕 

Thanks for your help,

Kaboom1

[richgalloway]

The error is reported because the specified file, /opt/splunk/etc/apps/myapp_hf/bin/app.py, doesn't exist.  I'm guessing the error stems from the change to app.conf, but that depends on what exactly you changed.  Please share a diff of app.conf.  In general, you can change the app's label (the name users see) in app.conf at will, but changes to the app id require a matching change to the subdirectory in which the app is stored.

[kaboom1]

Thank you for your message,

I checked all occurrences of the original app name in all files and I found that in many .py files the original name was used, so i replaced those with the new name.

Now the inputs.conf seems to work and I can see logs, the issue I have now is that the UI of the app shows a new error:   "Configuration page failed to load, the server reported internal errors which may indicate you do not have access to this page."

I am checking again what other replacements I need to do.

[_JP]

Did you delete the app you originally created on the heavy forwarder (HF) before re-deploying your app via deployment server (DS)? 

The other thing I would confirm is what permissions things are being deployed as - for example, what are the permissions on your python scripts between what worked, what is on the DS's copy of the app, and what is ending up on the HF once the app is deployed.