https://community.splunk.com/t5/Splunk-Search/Why-am-I-getting-quot-SyntaxError-Unexpected-token-lt-quot/m-p/216448#M63517 <P>If your file does contain an unparseable (within context) character, the easiest way to identify it is with a binary search. Cut the file in half and upload it. If it fails, cut it in half again until it doesn't. At that point, add back in half of what you cut out last. Keep going just like this and quickly you will find the one line that is causing the problem and go from there.</P> Tue, 08 Sep 2015 17:32:42 GMT woodcock 2015-09-08T17:32:42Z https://community.splunk.com/t5/Splunk-Search/Why-am-I-getting-quot-SyntaxError-Unexpected-token-lt-quot/m-p/216447#M63516 <P>Attempting to upload a "large" lookup file, 2 columns of 190k rows each presents the error "Your entry was not saved. The following error was reported: SyntaxError: Unexpected token &lt;.". I have confirmed that the file does not contain the listed token, nor any other token and is not over the 500mb limit (2.7mb unzipped) and even tried to gzip it to resolve the issue (1.2mb zipped). </P> <P>Has anyone else run into this issue and if so were you able to resolve the issue?</P> Tue, 08 Sep 2015 15:24:11 GMT https://community.splunk.com/t5/Splunk-Search/Why-am-I-getting-quot-SyntaxError-Unexpected-token-lt-quot/m-p/216447#M63516 pepper_seattle 2015-09-08T15:24:11Z https://community.splunk.com/t5/Splunk-Search/Why-am-I-getting-quot-SyntaxError-Unexpected-token-lt-quot/m-p/216448#M63517 <P>If your file does contain an unparseable (within context) character, the easiest way to identify it is with a binary search. Cut the file in half and upload it. If it fails, cut it in half again until it doesn't. At that point, add back in half of what you cut out last. Keep going just like this and quickly you will find the one line that is causing the problem and go from there.</P> Tue, 08 Sep 2015 17:32:42 GMT https://community.splunk.com/t5/Splunk-Search/Why-am-I-getting-quot-SyntaxError-Unexpected-token-lt-quot/m-p/216448#M63517 woodcock 2015-09-08T17:32:42Z https://community.splunk.com/t5/Splunk-Search/Why-am-I-getting-quot-SyntaxError-Unexpected-token-lt-quot/m-p/216449#M63518 <P>I checked the file for unparseable characters and could not find one. Should have mentioned that I've run into this error before with a "large" lookup and the fix was to gzip the file. Unfortunately that did not work this time around.</P> Tue, 08 Sep 2015 18:16:56 GMT https://community.splunk.com/t5/Splunk-Search/Why-am-I-getting-quot-SyntaxError-Unexpected-token-lt-quot/m-p/216449#M63518 pepper_seattle 2015-09-08T18:16:56Z https://community.splunk.com/t5/Splunk-Search/Why-am-I-getting-quot-SyntaxError-Unexpected-token-lt-quot/m-p/216450#M63519 <P>I, too, have seen problems like this with large files (both lookup CSVs and app TGZs) and the easiest way around it is to <EM>not</EM> use the GUI but transfer the file yourself with CLI (e.g. ftp) and make the associated configuration file changes manually (i.e. add the <CODE>lookup</CODE> stanza to <CODE>transforms.conf</CODE>). This always works.</P> Wed, 09 Sep 2015 17:43:52 GMT https://community.splunk.com/t5/Splunk-Search/Why-am-I-getting-quot-SyntaxError-Unexpected-token-lt-quot/m-p/216450#M63519 woodcock 2015-09-09T17:43:52Z https://community.splunk.com/t5/Splunk-Search/Why-am-I-getting-quot-SyntaxError-Unexpected-token-lt-quot/m-p/216451#M63520 <P>We found the issue to be a size limit on the proxy host which blocked us from uploading 'large' files. Unfortunately this was difficult to find due to the error messaging given. Either way, thanks for weighing in on this issue!</P> Wed, 09 Sep 2015 17:55:56 GMT https://community.splunk.com/t5/Splunk-Search/Why-am-I-getting-quot-SyntaxError-Unexpected-token-lt-quot/m-p/216451#M63520 pepper_seattle 2015-09-09T17:55:56Z https://community.splunk.com/t5/Splunk-Search/Why-am-I-getting-quot-SyntaxError-Unexpected-token-lt-quot/m-p/216452#M63521 <P>What was imposing this limit? Was it Splunk or a Firewall or what? If it was Splunk, what configuration did you change?</P> Wed, 09 Sep 2015 18:02:03 GMT https://community.splunk.com/t5/Splunk-Search/Why-am-I-getting-quot-SyntaxError-Unexpected-token-lt-quot/m-p/216452#M63521 woodcock 2015-09-09T18:02:03Z https://community.splunk.com/t5/Splunk-Search/Why-am-I-getting-quot-SyntaxError-Unexpected-token-lt-quot/m-p/216453#M63522 <P>Unfortunately I cannot say as I didn't make the change/don't have access to do so, if however I find out I will update you.</P> Wed, 09 Sep 2015 20:27:01 GMT https://community.splunk.com/t5/Splunk-Search/Why-am-I-getting-quot-SyntaxError-Unexpected-token-lt-quot/m-p/216453#M63522 pepper_seattle 2015-09-09T20:27:01Z https://community.splunk.com/t5/Splunk-Search/Why-am-I-getting-quot-SyntaxError-Unexpected-token-lt-quot/m-p/216454#M63523 <P>Great, it works. In our case there was an error message in proxy (nginx) log, in wich unavailability to write request body to /etc/nginx/client_body_temp/ described. Chmod 777 solved the problem. Now proxy is available send large requests to upstream and no error messages like message from subject</P> Tue, 29 Sep 2020 07:15:00 GMT https://community.splunk.com/t5/Splunk-Search/Why-am-I-getting-quot-SyntaxError-Unexpected-token-lt-quot/m-p/216454#M63523 m_efremov 2020-09-29T07:15:00Z