topic Re: Your entry was not saved. The following error was reported: SyntaxError: JSON Parse error: Unrecognized token '<‘. in Splunk Search

Your entry was not saved. The following error was reported: SyntaxError: JSON Parse error: Unrecognized token '<‘.

tristanmatthews — Wed, 16 Oct 2013 03:39:48 GMT

Hi,

So I'm inheriting some splunk code that I'm going through and cleaning up. It contains:

rex field=source "/data/splunk/(?<key>.*)/"

The search runs fine, when I navigate to it in the browser, (bread crumbs: splunk > manager >> Searches and reports >> [the search name] ) and modify a completely unrelated part of the search and go to save it it kicks the error

Your entry was not saved. The following error was reported: SyntaxError: Unexpected token <.

I'm fairly sure it's not escaping <> inside of quotes properly, so I can't save my search. I can however create a new search that has the exact same text in it.

Thanks,
Tristan

Re: Your entry was not saved. The following error was reported: SyntaxError: JSON Parse error: Unrecognized token '<‘.

had1980 — Fri, 14 Aug 2015 12:52:26 GMT

Hello, I am having the same issue. Did you solve it?

Thanks.

Re: Your entry was not saved. The following error was reported: SyntaxError: JSON Parse error: Unrecognized token '<‘.

muebel — Sat, 10 Oct 2015 01:07:56 GMT

whats the full search string?

Re: Your entry was not saved. The following error was reported: SyntaxError: JSON Parse error: Unrecognized token '<‘.

guilmxm — Sat, 10 Oct 2015 02:56:45 GMT

Hi,

See (end of the article)

http://www.w3schools.com/xml/xml_syntax.asp

Replace special characters by xml entities:

< by &lt;
> by &gt;
& by &amp;

And so on.

Re: Your entry was not saved. The following error was reported: SyntaxError: JSON Parse error: Unrecognized token '<‘.

the_wolverine — Fri, 01 Jul 2016 17:01:23 GMT

I'm also seeing several reports of this issue and in reviewing the query I see nothing wrong with it nor anything that was set unexpectedly.

Re: Your entry was not saved. The following error was reported: SyntaxError: JSON Parse error: Unrecognized token '<‘.

woodcock — Fri, 01 Jul 2016 18:43:46 GMT

This is a bug in all of the latest versions of Splunk and I do not know what causes it. I do not have an entitlement to open a case on it but hopefully you do so please DO open a case. You can tell that this is a bug because you will get the same error even if you change NOTHING and just try to resave your search.

I have a workaround: Copy down the details of the Search and save it fresh. It will ALWAYS save OK, but, it will NEVER be re-editable.

Re: Your entry was not saved. The following error was reported: SyntaxError: JSON Parse error: Unrecognized token '<‘.

woodcock — Fri, 01 Jul 2016 18:44:16 GMT

This is not the problem; this is a bug. See my answer.

Re: Your entry was not saved. The following error was reported: SyntaxError: JSON Parse error: Unrecognized token '<‘.

the_wolverine — Wed, 13 Jul 2016 16:49:46 GMT

Bug filed.

Re: Your entry was not saved. The following error was reported: SyntaxError: JSON Parse error: Unrecognized token '<‘.

woodcock — Wed, 13 Jul 2016 17:04:42 GMT

You are THE MAN!

Re: Your entry was not saved. The following error was reported: SyntaxError: JSON Parse error: Unrecognized token '<‘.

ben_leung — Wed, 13 Jul 2016 17:08:11 GMT

I am not able to reproduce. Is there something out of the ordinary in the savedsearches.conf? Maybe this has been fixed. I'm using version 6.3.4

Re: Your entry was not saved. The following error was reported: SyntaxError: JSON Parse error: Unrecognized token '<‘.

the_wolverine — Wed, 13 Jul 2016 17:09:58 GMT

It doesn't happen in most cases. Only small percentage of searches produce the error when modified.

Re: Your entry was not saved. The following error was reported: SyntaxError: JSON Parse error: Unrecognized token '<‘.

wandrilleD — Mon, 18 Jul 2016 09:18:40 GMT

Had the same mistake on all my dashboards, just restarted and everythings worked fine but I still don't understand why...

Re: Your entry was not saved. The following error was reported: SyntaxError: JSON Parse error: Unrecognized token '<‘.

hexx — Tue, 02 Aug 2016 18:49:20 GMT

Actually, @the_wolverine is THE LADY! 🙂

Re: Your entry was not saved. The following error was reported: SyntaxError: JSON Parse error: Unrecognized token '<‘.

the_wolverine — Wed, 24 Aug 2016 19:30:36 GMT

Do you happen to have a reliable way to reproduce the issue? Splunk support claims to have no idea about this bug.

Re: Your entry was not saved. The following error was reported: SyntaxError: JSON Parse error: Unrecognized token '<‘.

woodcock — Thu, 25 Aug 2016 15:40:20 GMT

I just tested this search on v6.3.4, build cae2458faef. The following search is syntactically valid and will save just fine on creation but when re-editing it, any attempt to save will generate this error:

Your entry was not saved.  The following error was reported: SyntaxError: Unexpected token < in JSON at position 0.

This is the problematic search:

|dbxquery connection=xxx query="SELECT%20TOP%20100%0ACONVERT(NVARCHAR(4000)%2C%5BNotes%5D)%0Afrom%20xyz%22"

Please update your support ticket with these details.

Re: Your entry was not saved. The following error was reported: SyntaxError: JSON Parse error: Unrecognized token '<‘.

woodcock — Thu, 25 Aug 2016 15:57:51 GMT

So you do New, give it a name like JSON BUG, use |dbxquery connection=xxx query="SELECT%20TOP%20100%0ACONVERT(NVARCHAR(4000)%2C%5BNotes%5D)%0Afrom%20xyz%22" as the search string and click Save. It will save just fine. Then click Edit, then Save (do not change anything) and you will get the error.

Re: Your entry was not saved. The following error was reported: SyntaxError: JSON Parse error: Unrecognized token '<‘.

fairje — Wed, 19 Oct 2016 12:50:19 GMT

I just wanted to point out that I just ran across this issue on my DMC. I was trying to edit the "Near Critical Disk Usage" alert to change it from 80% to 90%. I am currently running 6.4.3. Below is the current search string that is causing the error (even just saving it as is throws this error as pointed out).

| rest splunk_server_group=dmc_group_* /services/server/status/partitions-space 
| eval free = if(isnotnull(available), available, free) 
| eval usage = capacity - free 
| eval pct_usage = floor(usage / capacity * 100) 
| where pct_usage > 80 
| stats first(fs_type) as fs_type first(capacity) AS capacity first(usage) AS usage first(pct_usage) AS pct_usage by splunk_server, mount_point 
| eval usage = round(usage / 1024, 2) 
| eval capacity = round(capacity / 1024, 2) 
| rename splunk_server AS Instance mount_point as "Mount Point", fs_type as "File System Type", usage as "Usage (GB)", capacity as "Capacity (GB)", pct_usage as "Usage (%)"

The reason I point this out is your work-around of making a brand new search doesn't actually work. When I make a new report/alert and it still throws the error. The search runs just fine in the search bar.

It is also great because it is one of their searches, and is set-up to work on anyone's Splunk instances (assuming you have the DMC turned on). So it should be really easy to validate this bug and fix the issue. Not sure why your workaround isn't happening though. I'll get a bug report filed a bit later today with the above issue.

Re: Your entry was not saved. The following error was reported: SyntaxError: JSON Parse error: Unrecognized token '<‘.

lpolo — Tue, 08 Nov 2016 16:51:04 GMT

I faced this issue today. The only way I was able to make a change in the saved search was by cloning it.

Re: Your entry was not saved. The following error was reported: SyntaxError: JSON Parse error: Unrecognized token '<‘.

rh0dium — Fri, 25 Nov 2016 14:37:33 GMT

Hi all,

Had this problem - A JSON browser extension for viewing formatted JSON responses was getting in the way. Once I disabled that extension worked like charm.

Ref: https://answers.splunk.com/answers/247389/cant-add-input-for-rest-ta-your-entry-was-not-save-1.html

Re: Your entry was not saved. The following error was reported: SyntaxError: JSON Parse error: Unrecognized token '<‘.

woodcock — Mon, 05 Dec 2016 20:08:16 GMT

Exactly. It is a bug.