Troubleshoot problems with Splunk Assist
If you encounter problems where Splunk Assist displays an error or doesn't load properly, see the following table for common problems and their solutions.
|Splunk Assist displays "Error loading Assist"||Splunk Assist runs a test to see if the instance on where you activated it is suitable to run the service. If that test fails, this page can appear. You can run this test by using the following Splunk search. The |
Confirm that you are attempting to activate Splunk Assist on a supported Splunk Enterprise instance.
|Splunk Assist downloads remote assets as part of setup and activation. If it couldn't retrieve remote assets for the service, this page can appear. You can run the following Splunk search to determine if Splunk Assist successfully retrieved the remote assets. For best results, set the scope of the search to around the time when you updated the instance to version 9.0.0 or higher.
Confirm that you have network access to Splunk cloud services when you attempt to activate Splunk Assist.
|When you attempt to activate Splunk Assist, it displays
||If you have recently migrated your Splunk Enterprise instance from one operating system type to another, for example, from Windows to Linux or vice versa, these errors can appear. This is because the paths to the program files for Splunk Assist change due to the OS migration. To fix the problem, do the following:|
||On suitable Splunk Enterprise nodes where you haven't turned on Splunk Assist, this is expected behavior.|
|You see search heads appear in the Collection tier in the Overview page||If you configure your search heads to forward data, Splunk Assist sees this and might add the search head to the Collection tier as a "forwarder". If you have configured TLS certificates on the search heads, they might appear in the Collection tier on the Certificate Assist page as forwarders also.|
|You don't see all search heads in the Overview page||Splunk Assist collects indicators from search head captains only, because all configuration information in a cluster is the same.
Use Config Assist
This documentation applies to the following versions of Splunk® Enterprise: 9.0.0, 9.0.1, 9.0.2, 9.0.3, 9.0.4, 9.0.5, 9.0.6, 9.0.7, 9.1.0, 9.1.1, 9.1.2