Getting Data In

Invalid XML returned from REST API

giraffe
Explorer

When I insert an event and call the "services/search/jobs/export" REST endpoint, the XML that comes back is malformed and breaks XML parsing. There is another empty results document appended after the end of the document. Here is an example (with some valid result elements elided).

Any idea what could be causing this and how to work around it? We're running Splunk 4.2.3 on Windows 32.

<?xml version='1.0' encoding='UTF-8'?>
<results preview='0'>
<meta>
<fieldOrder>
<field>_cd</field>
<field>_indextime</field>
<field>_raw</field>
<field>_serial</field>
<field>_si</field>
<field>_sourcetype</field>
<field>_subsecond</field>
<field>_time</field>
<field>host</field>
<field>index</field>
<field>linecount</field>
<field>source</field>
<field>sourcetype</field>
<field>splunk_server</field>
</fieldOrder>
</meta>
<messages>
  <msg type="DEBUG">base lispy: [ AND group ]</msg>
  <msg type="DEBUG">search context: user="admin", app="search", bs-pathname="C:\splunk\etc"</msg>
</messages>
<result offset='0'>
    <field k='_cd'>
        <value><text>1:51</text></value>
    </field>
    <field k='_indextime'>
        <value><text>1320939650</text></value>
    </field>
    <field k='_raw'><v xml:space='preserve' trunc='0'>1320939650437 event-type=&quot;Test&quot; component=&quot;Job Controller&quot; giraffe-server=&quot;wlon1907051257&quot; <sg h='1'>group</sg>=&quot;cd290e81-75ca-4df6-b3e2-896d8085dc7b&quot; sequence=&quot;1&quot;</v></field>
    <field k='_serial'>
        <value><text>0</text></value>
    </field>
    <field k='_si'>
        <value><text>wlon1907051257</text></value>
        <value><text>main</text></value>
    </field>
    <field k='_sourcetype'>
        <value><text>giraffe-audit</text></value>
    </field>
    <field k='_subsecond'>
        <value><text>.437</text></value>
    </field>
    <field k='_time'>
        <value><text>2011-11-10 15:40:50.437 GMT Standard Time</text></value>
    </field>
    <field k='host'>
        <value><text>localhost</text></value>
    </field>
    <field k='index'>
        <value><text>main</text></value>
    </field>
    <field k='linecount'>
        <value><text>1</text></value>
    </field>
    <field k='source'>
        <value><text>giraffe-localdev</text></value>
    </field>
    <field k='sourcetype'>
        <value><text>giraffe-audit</text></value>
    </field>
    <field k='splunk_server'>
        <value><text>wlon1907051257</text></value>
    </field>
</result>
<result offset='1'>
        ....
</result>
</results>
<results preview='0'>
<meta>
<fieldOrder />
</meta>
</results>
<results preview='0'>
<meta>
<fieldOrder />
</meta>
</results>
<results preview='0'>
<meta>
<fieldOrder />
</meta>
</results>
Tags (5)
1 Solution

giraffe
Explorer

Post to services/search/jobs and set the exec_mode parameter to "oneshot". That will return the results in a single document, not a malformed stream of multiple documents.

View solution in original post

giraffe
Explorer

Post to services/search/jobs and set the exec_mode parameter to "oneshot". That will return the results in a single document, not a malformed stream of multiple documents.

giraffe
Explorer

I've upgraded to version 4.2.4 and still have the same issue.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...