Has anyone had any issues with the REST API returning text/plain
as a message type in a response message?
I've seen this happen a few times over the last couple of months, and have been assuming that it was a bug in my implementation, but after looking closer it appears that the issue may be coming from a weird response message coming back from splunkd.
Basically, my process does the following:
This error is happening on step 3. The URL is https://splunk.mydomain.com:8089/services/search/job/sid
Here's the actual response message I'm seeing:
<?xml version='1.0' encoding='UTF-8'?>
<response><messages><msg type='text/plain'></msg></messages></response>
My code is expecting that any <msg>
coming back from splunk to have a type
of "DEBUG", "INFO", "WARN", or "ERROR" so the type
of "text/plain" raises an exception.
I'm still in the process of investigating this on my end, but I was wondering if anyone else had see anything like this. I'm attempting to increase the amount of debug information I'm capturing during a failure, but since this is rather sporadic, it could be a while until it happens again. (It seems a bit early to file a bug since at this point I don't have anything reproducible or specific details about the timing, or even the sid
of the search job that returned the weird message.)
Any ideas?
Update:
I've done some more digging on my end, and determined that I seem to be getting a msg type of "text/plain" only when the HTTP response status is 204
(No Content). I was also able to capture a literal XML string returned by the splunkd
process, so I updated the example above accordingly.
Quick update (so I can "answer" this question)
The integration platform I'm using issued the following bug fix in regards to the "204" response code:
1-1W397J (IS_7-1-2_SrvPrtcl_Fix3)
The pub.client:http built-in service is not properly handling
response 204 from a client.
I've applied the fix, and haven't seen any evidence of this issue in quite some time. (I also added a special exception for "text/plain", so that it simply logs the issue rather than crashing.) So I'm assuming this was some weird fluke until I see something suggesting otherwise.
Quick update (so I can "answer" this question)
The integration platform I'm using issued the following bug fix in regards to the "204" response code:
1-1W397J (IS_7-1-2_SrvPrtcl_Fix3)
The pub.client:http built-in service is not properly handling
response 204 from a client.
I've applied the fix, and haven't seen any evidence of this issue in quite some time. (I also added a special exception for "text/plain", so that it simply logs the issue rather than crashing.) So I'm assuming this was some weird fluke until I see something suggesting otherwise.
Hi
Kindly please let me know the fix for this issue