Troubleshooting Splunk MINT

If you are experiencing issues using Splunk MINT, try the following troubleshooting tips to help solve the problem.

Issues with data flow in Splunk MINT

Mobile app data isn't showing up in the Splunk MINT Management Console or Splunk MINT App

• If you are not seeing all of your data, one reason might be that the API keys for your individual mobile app projects in MINT Management Console, and the MINT license for the Splunk MINT App, are not associated with the same MINT user account.
  

All of your mobile app projects and the MINT license must be associated with a single user account, which you created when you signed up for Splunk MINT. If multiple users in your organization have signed up with Splunk MINT individually and then created their own API keys for mobile app projects, the data for these mobile apps will not be displayed together in the Splunk MINT App.

After installing the Splunk MINT App, all searches hang at "parsing search"

• Searches do not work when you install the MINT license without a valid Splunk Enterprise license combined with LDAP authentication. To fix this issue, install a valid Splunk Enterprise license with the MINT license.

Issues with the Splunk MINT SDKs

The MINT SDK is crashing my mobile app

• Verify you are using the latest version of the MINT SDKs (the MINT App home page displays the current version of each SDK). Download the latest versions from:
  • Requirements and installation for Android
  • Requirements and installation for iOS
• Check the changelog and known issues for the MINT SDKs, which might explain any issues you are seeing:
  • Android SDK release notes
  • iOS SDK release notes

Issues with dashboards in the Splunk MINT App

The dashboard displays "Not found"

• The data model acceleration process is not enabled or hasn't finished yet.

The dashboards are slow

Follow these troubleshooting steps in Splunk Enterprise, as you would for any Splunk app:

• Inspect the search jobs.
• Check the logs for all MINT queries.
• Check ingestion performance using the Data Management Console.
• Make sure other add-ons are not running on the same Splunk Enterprise instance.

If your Splunk Enterprise instance is indexing more than 100GB:

• Use a distributed deployment. Standalone (single server) deployments will experience problems when indexing more than 100GB of MINT data.

Issues with connectivity with the Splunk MINT App

If you are connecting to the MINT Data Collector behind a firewall or proxy, follow the steps in Enable HTTPS traffic or Enable proxy support in the Splunk MINT App User Guide, depending on your configuration:

• Make sure you have opened an outbound connection for HTTPS connections.
• Make sure port 443 is open on the servers where the MINT Add-on is installed, on both an OS and network level.
• Make sure you are allowing the MINT URLs through your firewall.

If you experience any of the following issues:

• MINT Modular Input failures
• MINT Modular Input connectivity issues with a remote MINT Data Collector
• MINT App connectivity issues with remote MINT Data Collector authentication
• MINT App permission issues while managing CONF files for projects or tokens

Try running the following search from the MINT App to help identify issues with the MINT Add-on (which contains the MINT Modular Input) and the MINT App (specifically, the REST handlers):

index=_internal source="*mint.log*" (CRITICAL OR ERROR OR WARNING)

Issues with symbolication for iOS mobile apps

Errors are not being symbolicated correctly in the Splunk MINT App

• Verify that you have set up symbolication for iOS as described in Configure your project for symbolication in the Splunk MINT SDK for iOS Developer Guide.
• Reload the MINT App in Splunk Enterprise after setting up symbolication.
• If you are using a proxy, verify it has been set up correctly as described in Enable proxy support in the Splunk MINT App User Guide.

Memory dumps are displayed instead of stack traces

• iOS mobile apps usually don’t include debugging information, or this information is included in a .dSYM file that contains debugging symbols. To turn on debugging information and include it in your binary in your iOS mobile apps, set the Strip Debug Symbols setting to NO for all project configurations.

If you experience any of the following issues:

• MINT App Symbolicator middleware failures
• MINT App network connectivity or SSL issues with the remote MINT Symbolicator

Try running the following search from the MINT App to help identify issues between the MINT App and the MINT Symbolicator:

index=_internal source="*web_service.log*" "MINT:" (CRITICAL OR ERROR OR WARNING)

Need more help?

• See the MINT documentation for more information about MINT Management Console, the Splunk MINT App, and the Splunk MINT SDKs.
• See Splunk Answers for community support or ask your question there.