topic Re: Why doesn't my REST query to /services/authentication/users work anymore all of a sudden? in Getting Data In

Why doesn't my REST query to /services/authentication/users work anymore all of a sudden?

JuGuSm — Tue, 17 Oct 2017 16:35:22 GMT

Hi,

I use this query almost every day :

| rest /services/authentication/users

But today it doesn't work, I get this error message :

Failed to parse XML Body:<?xml version="1.0" encoding="UTF-8"?> <!--This is to override b...

And I don't have the end of this message.

Other rest commands work fine.

Re: Why doesn't my REST query to /services/authentication/users work anymore all of a sudden?

mbrettschneider — Thu, 11 Jan 2018 14:22:58 GMT

Same problem for me with
| REST /services/data/lookup-table-files

 | rest /services/authentication/users

works for me.

Re: Why doesn't my REST query to /services/authentication/users work anymore all of a sudden?

scorrie_splunk — Tue, 13 Mar 2018 19:27:35 GMT

I just had a case with the exact error. It turned out to be related to Splunk's inability to process the data due to some issue in the data.

In the case I worked on, there were base64 VALUES that had a hidden character at the beginning.

I am aware of one other case, which had unusual (not UTF-8) characters in the data.

Solution:
Fix your data. Examine it with a programming Tool (I use MacVIM, and GVIM). You may not see the problem when just looking at the logs.

If you can't fix your data prior to ingestion, what you can do is go into the search.log, determine which search (or source) is generating the problem and disable it. I realize this is a temporary solution, but it is a workaround until you can clean up your data.

I was not able to find any "Splunk Bugs" on this particular issue, possibly because it falls more under "quality of incoming data".

Re: Why doesn't my REST query to /services/authentication/users work anymore all of a sudden?

JuGuSm — Wed, 14 Mar 2018 05:31:22 GMT

My problem has been resolved a few months ago and it was exactly what you described.

Re: Why doesn't my REST query to /services/authentication/users work anymore all of a sudden?

effem — Mon, 25 Nov 2019 21:40:00 GMT

Hey guys,

how have you been able to fix this?

I have the same issue with
| rest splunk_server=local /services/search/jobs

Can't find a safe way to find the malicious characters, although splunk is stating its this:
Entity: line 305799: parser: Input is not proper UTF-8, indicate encoding !\nBytes: 0xC3 0x20 0x2E 0x2E

Re: Why doesn't my REST query to /services/authentication/users work anymore all of a sudden?

haraksin — Fri, 21 Jan 2022 02:07:46 GMT

If anyone is coming across this in 2022, you should know that there's a pretty easy workaround for this nowadays. The issue is with XML parsing, but Splunk allows you to output the results in JSON format with a simple change to your rest query. Instead of my query for lookup transforms:

| rest /servicesNS/nobody/app/data/transforms/lookups splunk_server=local

You just add the output_mode=json GET argument to it, like so:

| rest /servicesNS/nobody/app/data/transforms/lookups output_mode=json splunk_server=local

This resolved this issue for me immediately.