Splunk_SA_CIM not accesible and linking to another TA

[fatsug]

Hello community

We installed the CIM app in our SH cluster. The installation seemed to work as expected, all defaults no modifications. Afterwards when trying to launch the app we landed on a "ta_nix_configuration" page, trying to access the "cim_setup" page we got a 404.

We removed the app, rolled all members and re-installed. Once again it all seemed to work just fine. This time around we can access the cim_setup page, though if we try to access the "<baseurl>/app/Splunk_SA_CIM/" directly or use the "launch app" link in the GUI we land on the "<baseurl>/app/Splunk_SA_CIM/ta_nix_configuration" site.

Is this somehow the expected behaviour or have we got some crossed wires somewhere?

[fatsug · Accepted solution]

A re-install made the setup page available. I still don't get how the "launch" link directs to the TA_Linux app, though now we can at least start using the app

[PickleRick]

OK. First question - how did you install the CIM add-on?

[fatsug]

tgz from splunkbase -> deployer -> SH cluster

[fatsug]

well, unpacked from tgz and pushed from deployer

[PickleRick]

OK. I was afraid that you tried to install the app using gui and it landed on one SH only. If you pushed it properly from deployer, it should be OK.

No, it does not look like a  normal situation (although I seem to recall vaguely someone having a similar problem).

Are you sure your LB (you must have some HTTP rev-proxy in place) isn't doing something strange with your requests? Are you able to launch the CIM setup properly if you connect directly to one SH?

[fatsug]

Checked each SH individually, they all behave exactly the same.

I find the app in the management page, I klick the "launch app" link and I end up here:

<splunkURI>:8000/en-GB/app/Splunk_SA_CIM/ta_nix_configuration

[fatsug]

The CIM setup page now works just fine, it is the "launch app" or using the URI for the Splunk_SA_CIM app directly which lands me on the Splunkt_TA_Linux configuration page.

I have not noticed this behaviour for any other app so far, everything else seems to be working just fine. It is possible, of course, that the problem exists outside of Splunk.

At least I know this is not the expected behaviour, so now I just have to figure out why I cannot access the app without landing on the wrong page

[PickleRick]

That's strange because as far as I remember, the SA_CIM should _not_ have any "Launch app" link associated with it. It should have the "Set up" link which should lead to the setup screens (specifying filters, enabling acceleration and such). But there is nothing "launchable" within the app.

[fatsug]

OK, so the fact that there is a "launch" option might be the issue. Not that it is pointing to an incorrect location.