Getting Data In

Why do I get "error parsing XSL Stylesheet" when I look at REST API URLs directly on splunkWeb?

sideview
SplunkTrust
SplunkTrust

When using the rest API, the app I'm working on uses REST API Urls like

/splunkd/__raw/servicesNS/USERNAME/APPNAME/saved/searches

but whenever I paste these URL's into my browser to sanity check something, it doesn't work.
Specifically I get an error in Firefox saying "Error loading stylesheet: Parsing an XSLT stylesheet failed.", and in Chrome the page loads blank. At least with Chrome I can view-results and see the XML source.

Does anyone know what causes this and how I can fix it?

Tags (2)
0 Karma

sideview
SplunkTrust
SplunkTrust

What is happening, is that the /splunkd segment is giving you access to the somewhat more "real" rest API on the splunk management port (typically 8089),

and with the default output_mode being "xml", the results come back with this a directive on it to use a particular XSL stylesheet:

<?xml-stylesheet type="text/xml" href="/static/atom.xsl"?>

Now if you were actually making this request on the management port, there is an XSL file at /static/atom.xsl. However on the Splunkweb port it's a different http server and there is no such file there.

When you hit these URL's using something like curl or an XMLHttpRequest object in Javascript, they don't care about the missing stylesheet. But for whatever reason browsers treat this as a fatal error.

So bottom line, this isn't really a serious problem - it's just a mild and occasional annoyance for developers.

SOLUTION: You can quite easily fix this by copying the atom.xsl file from $SPLUNK_HOME/etc/system/atom.xsl over to $SPLUNK_HOME/share/splunk/search_mrsparkle/exposed/atom.xsl

and restart splunkweb. The problem will go away.

OR, you can also not use the default xml outputmode. 😃 Tack on ?output_mode=json to get json instead (and thus you wont get any xsl stylesheet directive at all.

0 Karma
Get Updates on the Splunk Community!

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...

.conf24 | Learning Tracks for Security, Observability, Platform, and Developers!

.conf24 is taking place at The Venetian in Las Vegas from June 11 - 14. Continue reading to learn about the ...

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...