topic Re: AttributeError: 'str' object has no attribute 'os_startIndex' on Splunk 6.2.1 on RedHat in Security

AttributeError: 'str' object has no attribute 'os_startIndex' on Splunk 6.2.1 on RedHat

ksim777 — Tue, 29 Sep 2020 09:13:04 GMT

When I clicked on Splunkenterprise/Settings/Lookup/LookupDefinitions
I have error
500 Internal Server Error
Return to Splunk home page
AttributeError: 'str' object has no attribute 'os_startIndex'
View more information about your request (request ID = xxxxx ) in Search
This page was linked to from https://servername:8000/en-AU/manager/search/lookups

I tried https://servername:8000/en-AU/debug/refresh.... (not working)
and it gives....
Refreshing admin/alert_actions OK
Refreshing admin/clusterconfig OK
Refreshing admin/collections-conf BadRequest
In handler 'collections-conf': Must use user context of 'nobody' when interacting with collection configurations (used user='ksim')
Refreshing admin/commandsconf OK
Refreshing admin/conf-deploymentclient OK
Refreshing admin/conf-inputs OK
Refreshing admin/conf-times OK
...
..
Refreshing admin/scheduledviews OK
Refreshing admin/script OK
Refreshing admin/serverclasses InternalServerError
In handler 'serverclasses': serverclass='_reload' not found
Refreshing admin/shclusterconfig OK
Refreshing admin/sourcetypes OK
Refreshing admin/ssl OK
Refreshing admin/syslog OK
Refreshing admin/tcpout-default OK
Refreshing admin/tcpout-group OK
Refreshing admin/tcpout-server OK
Refreshing admin/transforms-extract OK
Refreshing admin/transforms-lookup AttributeError 'str' object has no attribute 'os_startIndex'
Refreshing admin/transforms-reload ResourceNotFound
In handler 'transforms-reload': Invalid action for this internal handler (handler: transforms-reload, supported: list|_reload, wanted: list).
Refreshing admin/udp OK
Refreshing admin/ui-prefs OK
Refreshing admin/ui-tour OK

Re: AttributeError: 'str' object has no attribute 'os_startIndex' on Splunk 6.2.1 on RedHat

ksim777 — Tue, 29 Sep 2020 09:16:56 GMT

From Debug :-
File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/controllers/admin.py", line 1741, in listEntities
entities = en.getEntities(endpoint_path, **args)
File "/opt/splunk/lib/python2.7/site-packages/splunk/entity.py", line 131, in getEntities
offset = int(atomFeed.os_startIndex or -1)
AttributeError: 'str' object has no attribute 'os_startIndex'

Can anyone gives me tips how to go about solving this error ?
Have tried set timezone , as suggested in other website.. it didn't help

Re: AttributeError: 'str' object has no attribute 'os_startIndex' on Splunk 6.2.1 on RedHat

Gibbo87 — Fri, 04 Aug 2017 14:54:29 GMT

Hi,

I just encountered the same issue. In my case the header of a lookup had some special characters like "à". Removing those characters from the header and doing a debug refresh solved the issue.

The complex part is to identify which lookup has the wrong header.