All Apps and Add-ons

SOS: Instance to query is empty. ERROR Unexpected token o

mlorch
Path Finder

In SOS the "Instance to query" pulldown is empty.

In "_internal" i see the following error as soon as i click the pulldown:

ERROR [...] utility:49 - name=javascript, class=Splunk.Error, lineNumber=1, message=Uncaught SyntaxError: Unexpected token o, fileName=.../de-DE/app/sos/home

I have:
- Splunk 6.1.1 build 207789 on Suse Linux - Standalone
- Sideview Utils 1.3.5
- Splunk on Splunk version 3.2 - build 207364

It's a fresh Splunk installation, only installed to test SOS. ps_sos.sh and lsof_sos.sh are activated, index sos has values. Lookup splunk_servers_cache.csv lookes fine (only one entry with "stand-alone indexer" because nothing else connected).
Any hints?

0 Karma
1 Solution

mlorch
Path Finder

I found the solution:
The parameter "override_JSON_MIME_type_with_text_plain = True" in "web.conf"causes this problem. Setting it to "False" - this is also the default - solves the problem. SoS works as expected then.

Please don't ask me, why this parameter was set to "True". According to the documentation "this keeps it compatible with previous versions of Splunk". So lessons learned for me: Don't touch parameters you don't really need and understand.
Thanks for your help!

View solution in original post

0 Karma

mlorch
Path Finder

I found the solution:
The parameter "override_JSON_MIME_type_with_text_plain = True" in "web.conf"causes this problem. Setting it to "False" - this is also the default - solves the problem. SoS works as expected then.

Please don't ask me, why this parameter was set to "True". According to the documentation "this keeps it compatible with previous versions of Splunk". So lessons learned for me: Don't touch parameters you don't really need and understand.
Thanks for your help!

0 Karma

hexx
Splunk Employee
Splunk Employee

It does look like the issue is with Sideview Utils' Pulldown module parsing the search results created from the splunk_servers_cache.csv lookup file. Perhaps our dear @sideview will have some thoughts on this matter.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Can't replicate that here, so no chance of debugging... just in case you could try cleaning your browser cache in case something broken stuck, and try different version combinations such as the free internal use version of Sideview Utils from http://sideviewapps.com/apps/sideview-utils/ ... that's just fishing in murky waters though.

0 Karma

mlorch
Path Finder

You are right, there is a JavaScript error:

Uncaught SyntaxError: Unexpected token o
Sideview.utils.getResultsFromJSON
Splunk.Module.Pulldown.$.klass.buildOptionListFromResults
Splunk.Module.Pulldown.$.klass.renderResults
(anonymous function)
fire
self.fireWith
done
callback

Just did a local installation (Windows 7 notebook): No problem:

Splunk.Module.ResultsValueSetter - Although we're still loading the page we have to let modules cache contexts.
success - context dispatched for search= | inputlookup splunk_instances_info | search sos_server="***"

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Are there any JavaScript errors being logged to your browser's console?

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...