Troubleshoot problems with Splunk Assist
If you encounter problems where Splunk Assist displays an error or doesn't load properly, see the following table for common problems and their solutions.
Problem | Solution |
---|---|
Splunk Assist displays "Error loading Assist" | Splunk Assist runs a test to see if the instance on where you activated it is suitable to run the service. If that test fails, this page can appear. You can run this test by using the following Splunk search. The sud and sh results in the search must both return true for Splunk Assist to accept the instance as suitable.
Confirm that you are attempting to activate Splunk Assist on a supported Splunk Enterprise instance. |
Splunk Assist downloads remote assets as part of setup and activation. If it couldn't retrieve remote assets for the service, this page can appear. You can run the following Splunk search to determine if Splunk Assist successfully retrieved the remote assets. For best results, set the scope of the search to around the time when you updated the instance to version 9.0.0 or higher.
Confirm that you have network access to Splunk cloud services when you attempt to activate Splunk Assist. | |
When you attempt to activate Splunk Assist, it displays Splunk Assist could not process your request, try the operation again. When you then review the Splunk Enterprise logs, you see error messages similar to RuntimeError: assist binary not found .
|
If you have recently migrated your Splunk Enterprise instance from one operating system type to another, for example, from Windows to Linux or vice versa, these errors can appear. This is because the paths to the program files for Splunk Assist change due to the OS migration. To fix the problem, do the following:
|
You see Assist Supervisor cannot start, missing required secrets or Secret load failed in search results for the splunk_assist_internal_log
|
On suitable Splunk Enterprise nodes where you haven't turned on Splunk Assist, this is expected behavior. |
You see search heads appear in the Collection tier in the Overview page | If you configure your search heads to forward data, Splunk Assist sees this and might add the search head to the Collection tier as a "forwarder". If you have configured TLS certificates on the search heads, they might appear in the Collection tier on the Certificate Assist page as forwarders also. |
You don't see all search heads in the Overview page | Splunk Assist collects indicators from search head captains only, because all configuration information in a cluster is the same.
|
Use Config Assist |
This documentation applies to the following versions of Splunk® Enterprise: 9.0.0, 9.0.1, 9.0.2, 9.0.3, 9.0.4, 9.0.5, 9.0.6, 9.0.7, 9.0.8, 9.0.9, 9.0.10, 9.1.0, 9.1.1, 9.1.2, 9.1.3, 9.1.4, 9.1.5, 9.1.6, 9.2.0, 9.2.1, 9.2.2, 9.2.3, 9.3.0, 9.3.1
Feedback submitted, thanks!