Project

General

Profile

Troubleshooting » History » Version 1

Luke Murphey, 12/12/2018 06:26 PM

1 1 Luke Murphey
h1. Troubleshooting
2 1 Luke Murphey
3 1 Luke Murphey
Below are some pointers to help in debugging the application:
4 1 Luke Murphey
5 1 Luke Murphey
h2. Search for modular input errors
6 1 Luke Murphey
7 1 Luke Murphey
Run a search for the following and see if the logs indicate a problem with the modular input:
8 1 Luke Murphey
9 1 Luke Murphey
<pre>
10 1 Luke Murphey
index=_internal ((sourcetype=speedtest_modular_input OR sourcetype=speedtest_modular_input OR ) ERROR) OR (traceback AND NOT sourcetype=splunkd_ui_access)
11 1 Luke Murphey
</pre>
12 1 Luke Murphey
13 1 Luke Murphey
h2. Search for REST handler errors
14 1 Luke Murphey
15 1 Luke Murphey
Run a search for the following and see if the logs indicate a problem with the REST handler:
16 1 Luke Murphey
17 1 Luke Murphey
<pre>
18 1 Luke Murphey
index=_internal (source=network_tools_helper_controller.log OR source= speedtest_modular_input.log OR source= ping_modular_input.log)
19 1 Luke Murphey
</pre>
20 1 Luke Murphey
21 1 Luke Murphey
h2. Input fails and generates a "ConnectionError"
22 1 Luke Murphey
23 1 Luke Murphey
This can happen when the following is
24 1 Luke Murphey
25 1 Luke Murphey
# The IP address is invalid (if referring to the host by IP)
26 1 Luke Murphey
# The domain name cannot be resolved
27 1 Luke Murphey
# The port number provided is invalid (if a port is specified)
28 1 Luke Murphey
# Network connectivity is lost or a firewall blocks the connection
29 1 Luke Murphey
30 1 Luke Murphey
h2. Troubleshooting modular inputs that don't appear in the Splunk Manager
31 1 Luke Murphey
32 1 Luke Murphey
Look in the messages link in the top right of the page to see if you have a message like this:
33 1 Luke Murphey
34 1 Luke Murphey
<pre>
35 1 Luke Murphey
Unable to initialize modular input "ping" defined inside the app "network_toolkit": Introspecting scheme=web_input: script running failed (exited with code 1).
36 1 Luke Murphey
</pre>
37 1 Luke Murphey
38 1 Luke Murphey
You can search the internal log for related errors that indicate the modular input could not start:
39 1 Luke Murphey
40 1 Luke Murphey
<pre>
41 1 Luke Murphey
index=_internal "ModularInputs - Unable to initialize modular input"
42 1 Luke Murphey
</pre>
43 1 Luke Murphey
44 1 Luke Murphey
The best way to identify the source of the error if the modular input cannot be loaded by Splunk is to try to load it via Splunk's python interpreter directly.
45 1 Luke Murphey
46 1 Luke Murphey
Here is an example. Consider the modular input is in the following path:  /opt/splunk/etc/apps/network_tools/bin/ping.py
47 1 Luke Murphey
48 1 Luke Murphey
To test this, go to the path /opt/splunk/etc/apps/network_tools/bin/ using the CLI:
49 1 Luke Murphey
50 1 Luke Murphey
<pre>
51 1 Luke Murphey
cd /opt/splunk/etc/apps/network_tools/bin
52 1 Luke Murphey
</pre>
53 1 Luke Murphey
54 1 Luke Murphey
Next, run Splunk's python against the file:
55 1 Luke Murphey
56 1 Luke Murphey
<pre>
57 1 Luke Murphey
/opt/splunk/bin/splunk cmd python ping.py
58 1 Luke Murphey
</pre>
59 1 Luke Murphey
60 1 Luke Murphey
This should show an error, such as:
61 1 Luke Murphey
62 1 Luke Murphey
<pre>
63 1 Luke Murphey
Traceback (most recent call last):
64 1 Luke Murphey
  File "ping.py", line 1, in <module>
65 1 Luke Murphey
    somethingnotdefined
66 1 Luke Murphey
NameError: name 'somethingnotdefined' is not defined
67 1 Luke Murphey
</pre>