Splunk Enterprise

Splunk_SA_CIM not accesible and linking to another TA

fatsug
Contributor

Hello community

We installed the CIM app in our SH cluster. The installation seemed to work as expected, all defaults no modifications. Afterwards when trying to launch the app we landed on a "ta_nix_configuration" page, trying to access the "cim_setup" page we got a 404.

We removed the app, rolled all members and re-installed. Once again it all seemed to work just fine. This time around we can access the cim_setup page, though if we try to access the "<baseurl>/app/Splunk_SA_CIM/" directly or use the "launch app" link in the GUI we land on the "<baseurl>/app/Splunk_SA_CIM/ta_nix_configuration" site.

Is this somehow the expected behaviour or have we got some crossed wires somewhere?

Labels (1)
0 Karma
1 Solution

fatsug
Contributor

A re-install made the setup page available. I still don't get how the "launch" link directs to the TA_Linux app, though now we can at least start using the app

View solution in original post

0 Karma

fatsug
Contributor

A re-install made the setup page available. I still don't get how the "launch" link directs to the TA_Linux app, though now we can at least start using the app

0 Karma

PickleRick
SplunkTrust
SplunkTrust

OK. First question - how did you install the CIM add-on?

0 Karma

fatsug
Contributor

tgz from splunkbase -> deployer -> SH cluster

0 Karma

fatsug
Contributor

well, unpacked from tgz and pushed from deployer

0 Karma

PickleRick
SplunkTrust
SplunkTrust

OK. I was afraid that you tried to install the app using gui and it landed on one SH only. If you pushed it properly from deployer, it should be OK.

No, it does not look like a  normal situation (although I seem to recall vaguely someone having a similar problem).

Are you sure your LB (you must have some HTTP rev-proxy in place) isn't doing something strange with your requests? Are you able to launch the CIM setup properly if you connect directly to one SH?

0 Karma

fatsug
Contributor

Checked each SH individually, they all behave exactly the same.

I find the app in the management page, I klick the "launch app" link and I end up here:

<splunkURI>:8000/en-GB/app/Splunk_SA_CIM/ta_nix_configuration

0 Karma

fatsug
Contributor

The CIM setup page now works just fine, it is the "launch app" or using the URI for the Splunk_SA_CIM app directly which lands me on the Splunkt_TA_Linux configuration page.

I have not noticed this behaviour for any other app so far, everything else seems to be working just fine. It is possible, of course, that the problem exists outside of Splunk.

At least I know this is not the expected behaviour, so now I just have to figure out why I cannot access the app without landing on the wrong page

0 Karma

PickleRick
SplunkTrust
SplunkTrust

That's strange because as far as I remember, the SA_CIM should _not_ have any "Launch app" link associated with it. It should have the "Set up" link which should lead to the setup screens (specifying filters, enabling acceleration and such). But there is nothing "launchable" within the app.

0 Karma

fatsug
Contributor

OK, so the fact that there is a "launch" option might be the issue. Not that it is pointing to an incorrect location.

0 Karma
Get Updates on the Splunk Community!

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...