500 Internal Server Error - 'str' object has no attribute 'os_startIndex'

[gnazer]

Hello. I am testing Splunk version 4.3, build 115073 and I have the next error when I want to go to search App

500 Internal Server Error

Return to Splunk home page
AttributeError: 'str' object has no attribute 'os_startIndex'

This page was linked to from http://127.0.0.1:8000/en-US/app/launcher/home.

You are using 127.0.0.1:8000, which is connected to splunkd @115073 at https://127.0.0.1:8089 on Tue Jan 10 13:13:23 2012.

[mietmesplunk]

I've got the same error "500 Internal Server Error .. AttributeError..." after installing the WindowsApp.
At first, after accessing to the WindowsApp the error was shown.
After reboot i can't acces to splunk (same errer)

Renaming the "savedsearches.conf" brought no success.

(Windows 7, 64bit, Splunk 4.3)

[mietmesplunk]

I've renamed the "savedsearches.conf" in "Splunk/etc/apps/search/local" (as you wrote above).
And I've rebootet the system.
But without success.

Now i've done the following:

renamed the folder of the app "windows" to "windows-1"

After restart, i had access to the splunk webinterface and splunk seems working well. Of course, the app "windows" is not working.

Do you have any idea, how to get the windows app working?

thanks!

[FRoth]

Which "savedsearches.conf" did you rename (which directory)? Did you restart the service?

[araitz]

Please see my answer below for a workaround.

[araitz · Accepted solution]

Here is a workaround for the issue:

• From Splunk Web, go to Manager > Your Account
• In the Time zone setting, change the "default System Timezone" to a specific timezone
• Save the change. No restart is needed and the error should go away

We hope to have this fixed in an upcoming maintenance release.

[mietmesplunk]

This is not possible, when you have switched (downgraded) the licence to the coummunity-version, because the Menu "Your Account" is only available in the enterprise version

[FRoth]

He uses a Windows OS. Saved Searches with cron scheduler settings causes this error. See my workaround below.

[FRoth]

Workaround:

Rename savedsearches.conf in Splunk\etc\apps\search\local to savedsearches.conf.old
and restart Splunk.

Error Message still appears in the red top bar saying "'str' object has no attribute 'os_startIndex'" but you can access the search app at least.

[FRoth]

I also noticed that the SAVED SEARCHES did not show correctly in my dashboards. I used "stacked" columns but the graphs did not show up "stacked".

I figured out that I had generate a viewstate for every saved search. I saved a new search and copied the veiwstate for that new and correct chart several times in the file viewstates.conf.

An entry looks like this:

[charting:gvto8fi9]
ChartTypeFormatter_0_7_0.default = column
...
StackModeFormatter_0_10_0.default = stacked
...

The id after "charting:" is the reference to the actual saved search and had to be adjusted in every block.

[FRoth]

IMPORTANT: Every saved search containing a line to schedule the search causes the error. So it is recommended to remove the lines like

"cron_schedule = 0 * * * *" and "enableSched = 1"

[FRoth]

These are the entries in the web_service.log

2012-01-19 10:58:49,927 ERROR   [4f17e959e732440f0] messages:124 - 'str' object has no attribute 'os_startIndex'
Traceback (most recent call last):
  File "D:\Splunk\Python-2.7\Lib\site-packages\splunk\appserver\mrsparkle\controllers\messages.py", line 81, in index
    entries = splunk.entity.getEntities(uri)
  File "D:\Splunk\Python-2.7\Lib\site-packages\splunk\entity.py", line 159, in getEntities
    offset = int(atomFeed.os_startIndex or -1)
AttributeError: 'str' object has no attribute 'os_startIndex'

[FRoth]

Problem resides in entity.py and has to do with the used "uri" but I cant figure out how to enable debugging

[FRoth]

Same problem here.

Windows 2008 R2 Server 64bit.
Upgrade from 4.2.4 to 4.3.

Has anyone resolved this issue somehow?

[FRoth]

Has anyone tried to downgrade again?

[tortuganetworks]

Same Problem after upgrading from 4.2 to 4.3 on a Win2008 R2 machine when opening the search app.

[Livia]

Same Problem with Splunk 4.3 on a Win7 64-bit machine
when trying to configurate the "Windows" app.

[lguinn2]

What OS are you using?

[andrzejwasilews]

Me too, WinXP 32-bit after test upgrade:

500 Internal Server Error

Return to Splunk home page

AttributeError: 'str' object has no attribute 'os_startIndex'
This page was linked to from https://logsrv:8000/en-US/app/search/dashboard_live.

[booraczeq]

I have similar error, displayed as red warning at the top of the screen

-'str' object has no attribute 'os_startIndex'-

ver 4.3, build 115073, WinXP 32-bit