Reporting

Hadoop Connect - Scheduled Export Failure

bwmetz
New Member

I successfully created 65 different scheduled exports using Hadoop Connect without an error, but only 29 appear in the scheduled exports list. The remaining 36 all produce the following error when I attempt to re-add them. I checked HDFS and see the directories. Something seems messed up on the Splunk side.

2014-02-20 00:46:57,901 ERROR hdfs_export_handler.py [persistSavedSearch] [129] - Failed to save search object
Traceback (most recent call last):
  File "/opt/splunk_nfs/etc/apps/HadoopConnect/bin/hdfs_export_handler.py", line 126, in persistSavedSearch
    if not saved_search.save():
  File "/opt/splunk/lib/python2.7/site-packages/splunk/models/base.py", line 773, in save
    return self.create()
  File "/opt/splunk/lib/python2.7/site-packages/splunk/models/base.py", line 929, in create
    if super(SplunkAppObjModel, self).create():
  File "/opt/splunk/lib/python2.7/site-packages/splunk/models/base.py", line 758, in create
    newEntity = self.manager()._put_entity(new_endpoint, self.entity, messages, sessionKey=self.sessionKey)
  File "/opt/splunk/lib/python2.7/site-packages/splunk/models/base.py", line 520, in _put_entity
    return self._put_args(id, postargs, messages, sessionKey=sessionKey)
  File "/opt/splunk/lib/python2.7/site-packages/splunk/models/base.py", line 453, in _put_args
    serverResponse, serverContent = splunk.rest.simpleRequest(id, postargs=postargs, raiseAllErrors=True, sessionKey=sessionKey)
  File "/opt/splunk/lib/python2.7/site-packages/splunk/rest/__init__.py", line 553, in simpleRequest
    raise splunk.RESTException, (serverResponse.status, serverResponse.messages)
RESTException: [HTTP 409] [{'text': "In handler 'savedsearch': Unable to create saved search with name 'XYZ report'. A saved search with that name already exists.", 'type': 'ERROR', 'code': None}]

Has anyone run into this before? If so, how did you fix it? I don't see any CLI tools that might allow me to wipe these out and start again.

0 Karma

bosburn_splunk
Splunk Employee
Splunk Employee

It sounds like the other searches may of not finished.

If you have enterprise support, can you open a ticket up and message me the case number? I'm the SME for the Hadoop Connect stuff and can take a look at it.

Brian

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...