topic Re: Data not populating and overview search returns error in All Apps and Add-ons

Data not populating and overview search returns error

jberlin — Mon, 28 Sep 2020 15:07:09 GMT

select the server host via the overview I get the follow error:

Error in 'SearchParser': Missing a search command before '|'

The same is true for all metric types.

index=jmx sourcetype=jmx host="xxxxxxxx" jvmDescription="*" mbean_domain="java.lang" mbean_property_type="OperatingSystem" OR "Runtime"
| eval swapUsed=swapSpace-freeSwap
| eval memoryUsed=physMem-freePhysMem
| bucket _time span=1m
| stats first(name) as name first(version) as version first(arch) as arch first(jvmUptime) as jvmUptime first(cpuTime) as cpuTime first(processors) as cpus first(sysLoad) as sysLoad first(openFD) as openFD first(maxFD) as maxFD first(physMem) as physMem first(memoryUsed) as memoryUsed first(swapSpace) as swapSpace first(swapUsed) as swapUsed first(committed) as committed by _time host jvmDescription
| | stats first(name) as OS first(version) as Version first(arch) as Architecture by host jvmDescription | sort jvmDescription

Re: Data not populating and overview search returns error

Damien_Dallimor — Tue, 29 Oct 2013 05:36:10 GMT

I suggest you stick to the the out of the box documentation and default Simple XML view examples and name your sourcetype to be "jmx". For some reason editing the example xml views to change the sourcetype seems to be giving you some issues (as per other thread).

Re: Data not populating and overview search returns error

jberlin — Tue, 29 Oct 2013 13:21:22 GMT

Hello Damien,

I had only attempted changing it on one metric and then changed it back to JMX. So all of the Metrics are using the out of the box configuration. Same with the inputs.conf, sourcetype is set to JMX.

To validate that I do have any other configurations that are off, I attempted loading JMS on another instance of Splunk and continue to have the same issue with no data populating and overview continues to report the same error.

Error in 'SearchParser': Missing a search command before '|'

Thank you,

Re: Data not populating and overview search returns error

Damien_Dallimor — Tue, 29 Oct 2013 15:59:05 GMT

In your post above your have 2 pipes with nothing in between : ".....jvmDescription | | stats first(name)....."

Re: Data not populating and overview search returns error

jberlin — Tue, 29 Oct 2013 16:04:03 GMT

Yes that seems to be the issue for all of the metrics. Please correct me if I am wrong, but shouldn't that be populated by the app when I click on the server overview?

Re: Data not populating and overview search returns error

Damien_Dallimor — Tue, 29 Oct 2013 16:10:14 GMT

Is this on the version you have edited ? Or on a completely fresh version you have not edited in any way ? Also , what Splunk version are you on. I am trying to ascertain why your environment ,and no others I have ever seen , behaves like this. Can you post your entire jvm_operatingsystem.xml file please.

Re: Data not populating and overview search returns error

jberlin — Tue, 29 Oct 2013 16:19:10 GMT

this is a instance of Splunk6.0 using jmx2.0 with no changes.

Below is the config.xml and inputs.conf from the Forwarder side app. the same is on the Splunk server side, created using modular input.

Re: Data not populating and overview search returns error

jberlin — Mon, 28 Sep 2020 15:07:31 GMT

[jmx://jetty_xxxxxxxx]
config_file = jetty_xxxxxxx.xml
host = xxxxxxxx
index = jmx
polling_frequency = 60
sourcetype = jmx

Re: Data not populating and overview search returns error

Damien_Dallimor — Tue, 29 Oct 2013 16:22:39 GMT

Can you post your entire jvm_operatingsystem.xml file please

Re: Data not populating and overview search returns error

jberlin — Tue, 29 Oct 2013 16:27:59 GMT

I will email it to you as it does not fit in the comment or Post section of Splunk Answers.

Thank you for looking at this.

Re: Data not populating and overview search returns error

Damien_Dallimor — Tue, 29 Oct 2013 16:45:22 GMT

Works fine on 3 different Splunk instances for me.

I can only ascertain that somewhere in your environment there must be locally changed XML view (not the default ones) , that has an edit error in it because I can replicate the error by deliberately hacking my xml view to make it erroneous. Try grepping for "| | stats first(name)"

Re: Data not populating and overview search returns error

rongshengfang — Fri, 08 Nov 2013 17:37:14 GMT

Hi,

I am having exactly the same issue. My install was a fresh install of Splunk 5.0.4 and jmx app 2.0.3. Mine seems to be working for the most part, but whenever I click a host in the overview, I would get the error:

PARSER: Applying intentions failed Error in 'SearchParser': Missing a search command before '|'.

The only change I made after I installed the JMX app was creating a new config file based on the default config.xml. The changes I made to that new config file were host, jvmDescription, and jmxport.

Any help would be greatly appreciated!

Thanks!

Re: Data not populating and overview search returns error

Damien_Dallimor — Sat, 09 Nov 2013 06:18:08 GMT

From the Docs :

Dependencies

Splunk 5.0+ , if you only want to use as a JMX Modular Input
Splunk 6.0+ , if you want to use the Simple XML dashboards also

Re: Data not populating and overview search returns error

rongshengfang — Mon, 11 Nov 2013 13:12:36 GMT

Hi,

Could you elaborate a bit more on this:

Splunk 5.0+ , if you only want to use as a JMX Modular Input

and how this would be related to the errors I am seeing? Are you saying that the errors I am seeing are expected?

Thanks!