topic Re: Splunk REST API returns 500 when metadata inputs already exists in Getting Data In

Splunk REST API returns 500 when metadata inputs already exists

Craig1 — Thu, 05 Dec 2024 20:43:47 GMT

Whenever I send a POST request to create metadata inputs that already exists, I get a 500 Internal Server Error.

Error: Unable to create metadata inputs: Unexpected HTTP status: 500 Internal Server Error (500)

Expected behaviour: Do not return 500, return a payload that indicates that the resource already exists.

PickleRick — Thu, 05 Dec 2024 22:10:09 GMT

Ok. First and foremost - do you have the addon installed?

Secondly - did you look what's in the logs?

Craig1 — Thu, 05 Dec 2024 22:16:50 GMT

I'm just an API consumer, so not sure if I have the addon installed (do you have more specific instructions for me to pass on to the Splunk admin?).

As far as logs here is what I see:

<msg type="ERROR">
In handler 'splunk_ta_aws_iam_roles': bad character (52) in reply size</msg>
</messages>

Craig1 — Thu, 05 Dec 2024 22:18:18 GMT

Sorry I should also mention that this also happens with the roles endpoint which is where I got that message.