Troubleshoot problems with Splunk Assist

If you encounter problems where Splunk Assist displays an error or doesn't load properly, see the following table for common problems and their solutions.

Problem	Solution
Splunk Assist displays "Error loading Assist"	Splunk Assist runs a test to see if the instance on where you activated it is suitable to run the service. If that test fails, this page can appear. You can run this test by using the following Splunk search. The sud and sh results in the search must both return true for Splunk Assist to accept the instance as suitable. index="_internal" splunk_server="local" sourcetype="splunk_assist_internal_log" sh=* sud=* Confirm that you are attempting to activate Splunk Assist on a supported Splunk Enterprise instance.
	Splunk Assist downloads remote assets as part of setup and activation. If it couldn't retrieve remote assets for the service, this page can appear. You can run the following Splunk search to determine if Splunk Assist successfully retrieved the remote assets. For best results, set the scope of the search to around the time when you updated the instance to version 9.0.0 or higher. index="_internal" splunk_server="local" sourcetype="splunk_assist_internal_log" "Updating local node config" Confirm that you have network access to Splunk cloud services when you attempt to activate Splunk Assist.
When you attempt to activate Splunk Assist, it displays Splunk Assist could not process your request, try the operation again. When you then review the Splunk Enterprise logs, you see error messages similar to RuntimeError: assist binary not found.	If you have recently migrated your Splunk Enterprise instance from one operating system type to another, for example, from Windows to Linux or vice versa, these errors can appear. This is because the paths to the program files for Splunk Assist change due to the OS migration. To fix the problem, do the following: On the instance that experiences the error, open the $SPLUNK_HOME/etc/apps/splunk_assist/local/assist.conf file for editing. Within the file, locate the etag and local_path settings. Give both settings a value of _ (underscore). Do not use quotation marks around the value. Save the assist.conf file and close it. Restart the Splunk Enterprise instance. You might also encounter this error after you have activated Splunk Assist and subsequently choose to migrate the instance to a different operating system type. In this case, complete the previous procedure, but additionally locate the instance_id setting within the assist.conf file and give it a value of _.
You see Assist Supervisor cannot start, missing required secrets or Secret load failed in search results for the splunk_assist_internal_log	On suitable Splunk Enterprise nodes where you haven't turned on Splunk Assist, this is expected behavior.
You see search heads appear in the Collection tier in the Overview page	If you configure your search heads to forward data, Splunk Assist sees this and might add the search head to the Collection tier as a "forwarder". If you have configured TLS certificates on the search heads, they might appear in the Collection tier on the Certificate Assist page as forwarders also.
You don't see all search heads in the Overview page	Splunk Assist collects indicators from search head captains only, because all configuration information in a cluster is the same. If you have configured your search head clusters with more than one preferred search head cluster captain, you might see multiple instances of that search head cluster appear in Splunk Assist because of the multiple captaincies. If the search head cluster elects a new captain, you might see multiple instances of the search head cluster until the indicator cache on the first captain expires, about once a day.