Getting Data In

How to resolve the Fail to update configuration for add-on error on heavy Forwarder?

kiran331
Builder

Hi

I Installed a Add-on on the Heavy Forwarder, when I try to setup the Add-On using API and credentials, its showing the error

"Fail to update configuration for add-on xxx" but the add-on is working on other heavy Forwarder -2. Both are running under splunk user. I tried to copy the installation file from one HF to other and i got the below error, if its a permissions issue how to resolve this one?

"Fail to load configuration for add-on xxx"

Tags (2)
0 Karma

rpille_splunk
Splunk Employee
Splunk Employee

I'm not familiar with that add-on, so this advice is generic. If you've tried manually configuring it on the new forwarder, then I'd suggest disabling the add-on on the first forwarder and trying again.

If that doesn't work, look for all of the ways in which the new forwarder is different from the one on which you installed the add-on for testing, or anything that might be different about the configuration on the new forwarder vs the old one. Perhaps your API key expired? Perhaps you've exceeded your rate limit with the number of API calls you already made? Perhaps your browser is caching different credentials when you configure your connection to the API?

0 Karma

kiran331
Builder

Hi rpille,

I see the below error i n python.log ,when i setup the add-on.

2017-03-30 13:11:46,364 ERROR Run function: delete_password failed: Traceback (most recent call last):
File "/opt/splunk/etc/apps/TA-ciscoAMP4ep/bin/ta_ciscoamp4ep/solnlib/utils.py", line 150, in wrapper
return func(*args, **kwargs)
File "/opt/splunk/etc/apps/TA-ciscoAMP4ep/bin/ta_ciscoamp4ep/solnlib/credentials.py", line 179, in delete_password
all_passwords = self._storage_passwords.list()
File "/opt/splunk/etc/apps/TA-ciscoAMP4ep/bin/ta_ciscoamp4ep/splunklib/client.py", line 1459, in list
return list(self.iter(count=count, **kwargs))
File "/opt/splunk/etc/apps/TA-ciscoAMP4ep/bin/ta_ciscoamp4ep/splunklib/client.py", line 1419, in iter
items = self._load_list(response)
File "/opt/splunk/etc/apps/TA-ciscoAMP4ep/bin/ta_ciscoamp4ep/splunklib/client.py", line 1325, in _load_list
entries = _load_atom_entries(response)
File "/opt/splunk/etc/apps/TA-ciscoAMP4ep/bin/ta_ciscoamp4ep/splunklib/client.py", line 201, in _load_atom_entries
r = _load_atom(response)
File "/opt/splunk/etc/apps/TA-ciscoAMP4ep/bin/ta_ciscoamp4ep/splunklib/client.py", line 196, in _load_atom
return data.load(response.body.read(), match)
File "/opt/splunk/etc/apps/TA-ciscoAMP4ep/bin/ta_ciscoamp4ep/splunklib/data.py", line 77, in load
root = XML(text)
File "/opt/splunk/lib/python2.7/xml/etree/ElementTree.py", line 1300, in XML
parser.feed(text)
File "/opt/splunk/lib/python2.7/xml/etree/ElementTree.py", line 1642, in feed
self._raiseerror(v)
File "/opt/splunk/lib/python2.7/xml/etree/ElementTree.py", line 1506, in _raiseerror
raise err
ParseError: not well-formed (invalid token): line 33, column 37
.
2017-03-30 13:11:46,365 ERROR Run function: set_password failed: Traceback (most recent call last):
File "/opt/splunk/etc/apps/TA-ciscoAMP4ep/bin/ta_ciscoamp4ep/solnlib/utils.py", line 150, in wrapper
return func(*args, **kwargs)
File "/opt/splunk/etc/apps/TA-ciscoAMP4ep/bin/ta_ciscoamp4ep/solnlib/credentials.py", line 138, in set_password
self.delete_password(user)
File "/opt/splunk/etc/apps/TA-ciscoAMP4ep/bin/ta_ciscoamp4ep/solnlib/utils.py", line 150, in wrapper
return func(*args, **kwargs)
File "/opt/splunk/etc/apps/TA-ciscoAMP4ep/bin/ta_ciscoamp4ep/solnlib/credentials.py", line 179, in delete_password
all_passwords = self._storage_passwords.list()
File "/opt/splunk/etc/apps/TA-ciscoAMP4ep/bin/ta_ciscoamp4ep/splunklib/client.py", line 1459, in list
return list(self.iter(count=count, **kwargs))
File "/opt/splunk/etc/apps/TA-ciscoAMP4ep/bin/ta_ciscoamp4ep/splunklib/client.py", line 1419, in iter
items = self._load_list(response)
File "/opt/splunk/etc/apps/TA-ciscoAMP4ep/bin/ta_ciscoamp4ep/splunklib/client.py", line 1325, in _load_list
entries = _load_atom_entries(response)
File "/opt/splunk/etc/apps/TA-ciscoAMP4ep/bin/ta_ciscoamp4ep/splunklib/client.py", line 201, in _load_atom_entries
r = _load_atom(response)
File "/opt/splunk/etc/apps/TA-ciscoAMP4ep/bin/ta_ciscoamp4ep/splunklib/client.py", line 196, in _load_atom
return data.load(response.body.read(), match)
File "/opt/splunk/etc/apps/TA-ciscoAMP4ep/bin/ta_ciscoamp4ep/splunklib/data.py", line 77, in load
root = XML(text)
File "/opt/splunk/lib/python2.7/xml/etree/ElementTree.py", line 1300, in XML
parser.feed(text)
File "/opt/splunk/lib/python2.7/xml/etree/ElementTree.py", line 1642, in feed
self._raiseerror(v)
File "/opt/splunk/lib/python2.7/xml/etree/ElementTree.py", line 1506, in _raiseerror
raise err
ParseError: not well-formed (invalid token): line 33, column 37
.
2017-03-30 13:11:46,366 ERROR Run function: update failed: Traceback (most recent call last):
File "/opt/splunk/etc/apps/TA-ciscoAMP4ep/bin/ta_ciscoamp4ep/solnlib/utils.py", line 150, in wrapper
return func(*args, **kwargs)
File "/opt/splunk/etc/apps/TA-ciscoAMP4ep/bin/ta_ciscoamp4ep/solnlib/conf_manager.py", line 251, in update
encrypt_keys)
File "/opt/splunk/etc/apps/TA-ciscoAMP4ep/bin/ta_ciscoamp4ep/solnlib/conf_manager.py", line 110, in _encrypt_stanza
self._cred_mgr.set_password(stanza_name, json.dumps(encrypt_fields))
File "/opt/splunk/etc/apps/TA-ciscoAMP4ep/bin/ta_ciscoamp4ep/solnlib/utils.py", line 150, in wrapper
return func(*args, **kwargs)
File "/opt/splunk/etc/apps/TA-ciscoAMP4ep/bin/ta_ciscoamp4ep/solnlib/credentials.py", line 138, in set_password
self.delete_password(user)
File "/opt/splunk/etc/apps/TA-ciscoAMP4ep/bin/ta_ciscoamp4ep/solnlib/utils.py", line 150, in wrapper
return func(*args, **kwargs)
File "/opt/splunk/etc/apps/TA-ciscoAMP4ep/bin/ta_ciscoamp4ep/solnlib/credentials.py", line 179, in delete_password
all_passwords = self._storage_passwords.list()
File "/opt/splunk/etc/apps/TA-ciscoAMP4ep/bin/ta_ciscoamp4ep/splunklib/client.py", line 1459, in list
return list(self.iter(count=count, **kwargs))
File "/opt/splunk/etc/apps/TA-ciscoAMP4ep/bin/ta_ciscoamp4ep/splunklib/client.py", line 1419, in iter
items = self._load_list(response)
File "/opt/splunk/etc/apps/TA-ciscoAMP4ep/bin/ta_ciscoamp4ep/splunklib/client.py", line 1325, in _load_list
entries = _load_atom_entries(response)
File "/opt/splunk/etc/apps/TA-ciscoAMP4ep/bin/ta_ciscoamp4ep/splunklib/client.py", line 201, in _load_atom_entries
r = _load_atom(response)
File "/opt/splunk/etc/apps/TA-ciscoAMP4ep/bin/ta_ciscoamp4ep/splunklib/client.py", line 196, in _load_atom
return data.load(response.body.read(), match)
File "/opt/splunk/etc/apps/TA-ciscoAMP4ep/bin/ta_ciscoamp4ep/splunklib/data.py", line 77, in load
root = XML(text)
File "/opt/splunk/lib/python2.7/xml/etree/ElementTree.py", line 1300, in XML
parser.feed(text)
File "/opt/splunk/lib/python2.7/xml/etree/ElementTree.py", line 1642, in feed
self._raiseerror(v)
File "/opt/splunk/lib/python2.7/xml/etree/ElementTree.py", line 1506, in _raiseerror
raise err
ParseError: not well-formed (invalid token): line 33, column 37

0 Karma

rpille_splunk
Splunk Employee
Splunk Employee

Try configuring it without copying over the configurations from the first forwarder. Because this add-on involves credentials, copying over the files probably will not work.

0 Karma

kiran331
Builder

Yes I tried installing the add-on directly on HF, it shows the above errors and then I tried the copy option.

0 Karma

rpille_splunk
Splunk Employee
Splunk Employee

Why are you trying to configure the add-on on two different heavy forwarders? Are you planning to manually split input collection between two heavy forwarders without overlapping them?

Which add-on is this?

0 Karma

kiran331
Builder

I need this on only one Heavy Forwarder, For Testing I installed it on other. Its working on other Heavy Forwarder. Its TA-CiscoAmp

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...