I ran into the same issue for Falcon Crowdstrike Event Streams and the Splunk Add-On for AWS on my Heavy Forwarders. This indicates it was likely a Splunk config issue, rather than a Splunk app issue. Splunk Support recommended the following, which fixed the problem right away. The value for one of the parameters in the server.conf file is not set up in the expected format. Please perform the below steps in your HF in which the Box add-on UI page(s) are not loading properly: 1.Go to /splunk/etc/system/local/server.conf file. 2.Update the value of the enableSplunkdSSL parameter from True to true on the [sslConfig] stanza. 3.Restart the HF. If your server.conf file doesn't specifically have an invalid enableSplunkdSSL attribute, then I suspect that your issue may be some other SSL configuration. It's worth noting too that using splunk cmd btool check --debug did not detect this issue during troubleshooting.
... View more