I installed the App Exporter on Splunk Enterprise 6.5.0. While launching the app, the dashboard shows this message:
Error in 'SearchParser': Encountered the following error while validating macro 'truncate(description, 150)': length (arg2) must be an integer greater than or equal to zero.
This message shows up with
admin as well as
Please suggest if I need to change any settings or provide additional capabilities to the roles/user.
I just ran into this same problem with app exporter version 1.1. The truncate(2) macro that comes with the app exporter references the length variable as $n$, but uses the term length in the validation expression. Update the validation expression to read "isint(n) AND n>=0" and it should work.
Again, you likely have a different app installed that shares a macro of the same name globally, resulting in their validation expression being used with the App Exporter macro - and if they use different variables then errors will happen.
Hi Martin, thanks for your response. I did verify this. SA-utils has a global truncate(2) macro. However, I disabled this macro for testing without success. Updating the validation expression for the truncate(2) macro in the app_exporter context is what fixed this error for me.
It must be a bug in Splunk. This particular search head is running 6.5.0. I confirmed there is no validation expression shipped with App Exporter in my personal dev environment. The validation expression I found in the truncate(2) macro under the App Exporter context was identical to the validation expression used by SA-utils, although the eval was different.
I came across this today
Seems to be a problem with having Enterprise Security installed with a truncate macro defined with
validation = isint(length) AND length>=0
but it's mixing the args defined in the app exporter of the same name with the validation expression from SA-Utils, but of course the args are different - App exporter uses n for length, so if you change the macro, which shows in the GUI to be the app exporter one, and replace length with field, the macro of course works.
Sounds a lot like a different app has defined a globally shared macro of the same name, with clashing parameter validations.
Check your environment for a second
truncate(2) macro to narrow that down.
length (arg2) must be an integer greater than or equal to zero. must be coming from the
Validation Error Message you have put for the
Validation Expression of macro definition.
Can you check what are
Validation Expression and
Validation Error Message and if they are as per your requirement. You can check them by going to
Settings » Advanced search » Search macros » yourMacro.
Also since calculating the length is for strings (generally) and in your case you are passing integer
arg2 , so as a calculated guess, if everything else seems to be the way it should be, can you check if you have put in the
len($arg2$) >= 0 as
Validation Expression and try to tweak it to
len(tostring($arg2$)) >=0 to see if it resolves it.