Getting Data In

Why am I receiving "cannot concatenate 'str' and 'NoneType' objects" error when uploading a log file?

dwoehr
Explorer

Sorry for bringing this up again, but the other questions haven't been answered yet in a way that would help us.

I'm getting said error, but only when trying to upload the whole log file. I tried just uploading a single line, that works fine.

We're currently using Splunk 6.5.0 on Ubuntu (16, I think) and the log files are custom log files created by NGINX, but nothing special, here's an anonymized sample line:

2016-11-14T16:35:28+01:00 xxx.xxx.xxx.xxx - xxx.xxx.xxx.xxx 443 GET /xxx/xxx/xxx.xxx xxx=xxx&xxx=xxx&xxx=xxx&xxx=xxx&xxx=xxx 200 1267 0.419 "Apache-HttpClient/4.5.1 (Java/1.8.0_92)"

I already checked the file, if there's any lines with more or less entries, that might result in a null value, but they all had the 12 entries we are expecting.

Any more ideas on what the problem could be? Is there maybe a validation tool that we can run to check, if the log file is OK to import? The check I ran was just a simple CSV parser that checked line by line for the number of entries, so maybe that missed something.

Thanks a lot!

jawaharas
Motivator

Seems to be a browser session issue. Opening the Splunk Web in 'incognito' mode in Chrome fixed for me.

jawaharas
Motivator

@dwoehr

Can you accept the answer if it's helped you? Thanks.

edoardo_vicendo
Contributor

it worked also for me, thanks for your solution

scoughlin1
Path Finder

You can also try to open the file in an editor and save to a different type like UTF-8 instead of ASCII. That worked for me just now. (v7.2.1)

0 Karma

SirSpammenot
Engager

I get this error trying to do the friggin Splunk tutorial!

Using the provided access_30DAY.log file from Splunk Fundamentals 1, on a Mac with Chrome, against the Enterprise Splunk 30 day single instance in the DMG.
https://s3-us-west-2.amazonaws.com/splunk-fundamentals-data/Splunk_f1_Data.zip
https://download.splunk.com/products/splunk/releases/7.1.0/osx/splunk-7.1.0-2e75b3406c5b-macosx-10.1...

No clue how to work around a provided tutorial file executed against a caned Splunk instance..,

sri_ratp
Engager

I've got the same error when uploading file from Firefox. Then I used Chrome and it works

zaynaly
Explorer

This works!

0 Karma

mattymo
Splunk Employee
Splunk Employee

Hi dwoehr!

A couple of followup questions...

  1. what is the file extension on the file that errors out? (ie, .txt? .log?
  2. how big is the file?
  3. what version of splunk are you using?
- MattyMo
0 Karma

ralphreijs
Explorer

If this happens just for one file
Are there any weird unicode characters in the file that might mess it up?
This would be likelier to happen in CSVs than in LOG files.

If this happens for all files
Try it out in a different browser.
For me, was getting consistent errors for different files, and different file types.
When I stopped using Safari and started using Firefox, it was fixed.
Safari has much stricter security than most other browsers, which can get in the way of some web-apps functionalities.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The error message you cite sounds like it comes from Python rather than Core Splunk. That would imply you are using a scripted or modular input. Is that the case? If so, which one?

---
If this reply helps you, Karma would be appreciated.
0 Karma

zaynaly
Explorer

This issues happens when using FF or IE. Chrome handles the upload just fine. Please submit this as feedback to Firefox to fix this issue.

0 Karma

dwoehr
Explorer

No, I just used Splunk's Web-Interface (Settings -> Add Data -> Upload)

0 Karma

ralphreijs
Explorer

I have the exact same when uploading a .CSV file through the initial "Add Data" screen on the web interface.

There are probably weird characters in my CSV, but I've cleaned all quotes, magic quotes, and other characters that might be confusijng, but it opens fine (with correct number of columns) in Excel and Numbers.app.

Any thoughts?
Cheers,

Ralph

0 Karma

ralphreijs
Explorer

To me it happened with every file, and every file type.
Changing browser from Safari to Firefox fixed it.

JoJoRabbit
Engager

I changed browser from Chome to Edge and it worked - could also try incognito instead

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...