Security

AttributeError: 'str' object has no attribute 'os_startIndex' on Splunk 6.2.1 on RedHat

ksim777
Engager

When I clicked on Splunkenterprise/Settings/Lookup/LookupDefinitions
I have error
500 Internal Server Error
Return to Splunk home page
AttributeError: 'str' object has no attribute 'os_startIndex'
View more information about your request (request ID = xxxxx ) in Search
This page was linked to from https://servername:8000/en-AU/manager/search/lookups

I tried https://servername:8000/en-AU/debug/refresh.... (not working)
and it gives....
Refreshing admin/alert_actions OK
Refreshing admin/clusterconfig OK
Refreshing admin/collections-conf BadRequest
In handler 'collections-conf': Must use user context of 'nobody' when interacting with collection configurations (used user='ksim')
Refreshing admin/commandsconf OK
Refreshing admin/conf-deploymentclient OK
Refreshing admin/conf-inputs OK
Refreshing admin/conf-times OK
...
..
Refreshing admin/scheduledviews OK
Refreshing admin/script OK
Refreshing admin/serverclasses InternalServerError
In handler 'serverclasses': serverclass='_reload' not found
Refreshing admin/shclusterconfig OK
Refreshing admin/sourcetypes OK
Refreshing admin/ssl OK
Refreshing admin/syslog OK
Refreshing admin/tcpout-default OK
Refreshing admin/tcpout-group OK
Refreshing admin/tcpout-server OK
Refreshing admin/transforms-extract OK
Refreshing admin/transforms-lookup AttributeError 'str' object has no attribute 'os_startIndex'
Refreshing admin/transforms-reload ResourceNotFound
In handler 'transforms-reload': Invalid action for this internal handler (handler: transforms-reload, supported: list|_reload, wanted: list).
Refreshing admin/udp OK
Refreshing admin/ui-prefs OK
Refreshing admin/ui-tour OK

Tags (1)

Gibbo87
Explorer

Hi,

I just encountered the same issue. In my case the header of a lookup had some special characters like "à". Removing those characters from the header and doing a debug refresh solved the issue.

The complex part is to identify which lookup has the wrong header.

0 Karma

ksim777
Engager

From Debug :-
File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/controllers/admin.py", line 1741, in listEntities
entities = en.getEntities(endpoint_path, **args)
File "/opt/splunk/lib/python2.7/site-packages/splunk/entity.py", line 131, in getEntities
offset = int(atomFeed.os_startIndex or -1)
AttributeError: 'str' object has no attribute 'os_startIndex'

Can anyone gives me tips how to go about solving this error ?
Have tried set timezone , as suggested in other website.. it didn't help

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...