search

Cisco-AMP / amp4e_splunk_events_input

BSD 2-Clause "Simplified" License
8 stars 12 forks source link

New input - save issue #67

Closed ghost closed 3 years ago

ghost commented 3 years ago

Has anyone managed to resolve this? I'm having an issue using the latest Splunk version and newest app version 2.0.1. When I try and save the new input, it just sits on the page saying 'Please wait while we setup the AMP for Endpoints streaming resource...'

Connection works '2021-03-22 14:59:47,165 INFO Amp4eEvents - Received response from ApiService (200)' and I can curl all information, tested using /v1/events. I have even disabled handshake in base.connections.py

I have even tried to create the inputs.conf file manually, using the inputs.conf.spec

marianomromano commented 3 years ago

I am running into the same issue. I was hoping on finding someone that has a version of the inputs.conf that I can use as a template because when I try to use inputs.conf.spec, that does not work

ghost commented 3 years ago

I've left this for a while. Has anyone had luck on a workaround?

TheWoodRanger commented 3 years ago

Same issue. We see a 404 in splunkd_ui_access.log when saving the input with it trying to hit: /en-us/splunkd/__raw/servicesNS/admin/amp4e_events_input/data/inputs/amp4e_events_input?outputmode=json&=1623868761510

No error returned, no information. It just hangs. Seems a LOT of people are having this problem.

twokyum commented 3 years ago

Has anyone had luck on a workaround please?

mikebrose1 commented 3 years ago

Working on a POC with splunk and i am seeing the same issue.