topic Re: Distributed search error on GUI configuration: entry not saved in Deployment Architecture

Distributed search error on GUI configuration: entry not saved

landen99 — Mon, 04 Sep 2017 00:26:24 GMT

After entering the search peer information into the Distributed Search-Add search peers window, I get the following error:

Your entry was not saved. The following error was reported: SyntaxError: Unexpected token < in JSON at position 0.

My URI is:
https://192.168.###.###:8089

Then when I try to search "index=_internal sourcetype=splunkd error | head 99", I get the error:

Splunk cannot authenticate the request. CSRF validation failed.

What could the issue be and how should I troubleshoot this one?

A quick note about my server.conf in etc\system\local, the current setting is:

[sslConfig]
enableSplunkdSSL = false
sslPassword = $1$MhI5x3Z+VX7R

Splunk keeps adding sslpassword even though I have enable splunkdssl set to false, despite stopping splunk to edit the file. At one point, I tried encryption and tried to back out of it when it didn't work as I had expected.

Re: Distributed search error on GUI configuration: entry not saved

woodcock — Mon, 04 Sep 2017 16:33:14 GMT

I don't know about the 2nd error, but the first one is a bug which is easily worked-around:
https://answers.splunk.com/answers/106487/your-entry-was-not-saved-the-following-error-was-r.html

Re: Distributed search error on GUI configuration: entry not saved

landen99 — Mon, 04 Sep 2017 17:01:04 GMT

There is no search involved here. What do you mean?

Re: Distributed search error on GUI configuration: entry not saved

jkat54 — Tue, 05 Sep 2017 01:45:38 GMT

Did you see this answer about browser plugins?

Ref: https://answers.splunk.com/answers/247389/cant-add-input-for-rest-ta-your-entry-was-not-save-1.html

I think I got this error once and I went into the DMC setup page and without making any changes, clicked on save configuration and it fixed the problem.

Re: Distributed search error on GUI configuration: entry not saved

deepashri_123 — Tue, 16 Jan 2018 08:52:53 GMT

Hi @ landen99,

Can u help with how u addressed the second CSRF issue ? I am facing a similar issue.

Re: Distributed search error on GUI configuration: entry not saved

landen99 — Tue, 16 Jan 2018 20:51:23 GMT

Both SH and IDX must be set to either encrypt or not.

Re: Distributed search error on GUI configuration: entry not saved

deepashri_123 — Wed, 17 Jan 2018 08:11:14 GMT

Thanks!!!