Splunk Search

PARSER: Applying intentions failed This search cannot be parsed when parse_only is set to true

Moogz
Splunk Employee
Splunk Employee

Hey All,

I have a search that displays a timechart correctly in the search area but not when I'm trying to display it on a form.

The purpose of the search is to display a timechart from two searches. The subsearch is meant to bring back 1 value that is used as a constant value (kind of like an avg line).

sourcetype=source1 VName="$input1$" LKPA="$input2$" OR LKPZ="$input2$" | fields modID | eval tsInServ = [search sourcetype=source2 SRCA=$input2$ OR SRCZ=$input2$ Status="blah" | stats dc(Entity_ID) AS query] | timechart span=1mon dc(modID),max(tsInServ)

Again, works in the search area, but not when i put it in a form/dashboard - I get the following error and the chart shows up blank

PARSER: Applying intentions failed This search cannot be parsed when parse_only is set to true

Any help would be appreciated!

Tags (3)

sowings
Splunk Employee
Splunk Employee

I too, suffered from the same issue. I've had an extensive dialog with application developers at Splunk, and I finally have this to report.

The core of the issue is that client-side Javascript in the (simple or advanced XML) page is attempting to validate your search string before token substitution, and that parse is failing. You're not even getting to the point of kicking off the search because the Intention system says "no way".

The workaround I was given was to convert the view to advanced XML (if it was in simple XML), and then convert it to using Sideview utils. Personally, for maintainability and ease of use, I'd prefer to stay in simple XML, but Sideview simplifies working with advanced XML quite a bit, and most notably, doesn't suffer from this parsing issue.

Good luck.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...