Splunk Enterprise 10.0.0 unable to "browse more apps"

[ww9rivers]

I am running Splunk Enterprise 10.0.0 on Rocky Linux 9.6 with a developer license.

When I try to "Browse more apps" to install an app directly from Splunkbase, I get this in Chrome and Edge:

Unexpected token '<', "<?xml vers"... is not valid JSON

 In Firefox, the message becomes "JSON.parse: unexpected character at line 1 column 1 of the JSON data"

I can download apps from Splunkbase and then install them from files. But this is kinda annoying!

Anyone else seeing this issue?

[isoutamo]

At least some ARM / Apple silicon beta has some app management issues. Maybe there is something similar in some cases. So if those change browser / disable extensions didn't help you, you should create a support ticket to Splunk.

[livehybrid]

Hi @ww9rivers 

Using the developer tools/console in your browser, under the network tab are you able to see if any pages return a non 200 response? If so whcih are these and does the payload provide any further info/errors?

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[ww9rivers]

I checked the Network pane in the DevTools, this seems to be the request that failed:

GET https://<MYHOSTNAME>:8000/en-US/splunkd/__raw/services/appsbrowser/v1/app/?order=latest&offset=0&include=release%2Crelease.manifest%2Ccategories%2Ccreated_by%2Cicon%2Cdownload_count&limit=20

The response code is 502, a small XML body, with this message:

Error connecting: error:0A000086:SSL routines::certificate verify failed - please check the output of the `openssl verify` command for the certificates involved; note that if certificate verification is enabled (requireClientCert or sslVerifyServerCert set to "true"), the CA certificate and the server certificate should not have the same Common Name.

 I ran openssl verify:

echo | /app/splunk/bin/openssl s_client -connect <MYHOSTNAME>:8000 | /app/splunk/bin/openssl verify -CAfile /app/splunk/etc/auth/cacert.pem

That verifies OK.

The MYHOSTNAME is resolved with the `/etc/hosts` file on the host. And that does show it resolved OK in the browser DevTools.

I guess this is a problem local to the host itself, as the GET request is likely trying to get a list of apps installed. But it is unclear what it is.

[PickleRick]

This might be an issue similar to https://community.splunk.com/t5/Installation/500s-when-updating-apps-from-GUI-with-walkaround/m-p/63...

[kiran_panchavat]

@ww9rivers 

Some users have resolved this by switching to Firefox or disabling problematic Chrome extensions (like ad blockers or privacy tools) that interfere with Splunk Web's JSON handling

[ww9rivers]

Thank you for the response.

I have not tried disabling extensions in Chrome. But I do not have any extensions in Edge, and I ran Firefox in Private mode. So I am not sure this is the issue.

By the way, those were done on my work laptop with the same browsers I use for work where Splunk runs in the cloud, the version is 9.3.2411.112. I don't have the same issue there.

That does remind me to try using my personal PC. I tried Edge there (Private window, no extension). The same error. I installed Chrome fresh on that PC . . . the same error.

[nathans7]

I had this same issue aswell. In my case, I was messing around with IPTABLES on the host that was running splunk, and by flushing and resetting iptables I ruined the network connection. 

If you run splunk through docker, this fix is very easy. You can just restart docker (sudo systemctl restart docker) and it should reconfigure automatically.

I didn't dive into doing this bare metal, but I hope this points someone in the right direction!