All Apps and Add-ons

Why am I receiving "error while validating macro... must be an integer greater than or equal to zero" in the dashboard while launching App Exporter?

miteshp250283
Path Finder

I installed the App Exporter on Splunk Enterprise 6.5.0. While launching the app, the dashboard shows this message:

Error in 'SearchParser': Encountered the following error while validating macro 'truncate(description, 150)': length (arg2) must be an integer greater than or equal to zero. 

This message shows up with admin as well as power roles.

Please suggest if I need to change any settings or provide additional capabilities to the roles/user.

Thanks, Mitesh.

0 Karma

cyrix
Explorer

I just ran into this same problem with app exporter version 1.1. The truncate(2) macro that comes with the app exporter references the length variable as $n$, but uses the term length in the validation expression. Update the validation expression to read "isint(n) AND n>=0" and it should work.

smitra_splunk
Splunk Employee
Splunk Employee

Thank you @cyrix . This worked for me.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Again, you likely have a different app installed that shares a macro of the same name globally, resulting in their validation expression being used with the App Exporter macro - and if they use different variables then errors will happen.

0 Karma

cyrix
Explorer

Hi Martin, thanks for your response. I did verify this. SA-utils has a global truncate(2) macro. However, I disabled this macro for testing without success. Updating the validation expression for the truncate(2) macro in the app_exporter context is what fixed this error for me.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

That's highly unlikely, considering the App Exporter doesn't ship any validation expression.

0 Karma

cyrix
Explorer

It must be a bug in Splunk. This particular search head is running 6.5.0. I confirmed there is no validation expression shipped with App Exporter in my personal dev environment. The validation expression I found in the truncate(2) macro under the App Exporter context was identical to the validation expression used by SA-utils, although the eval was different.

0 Karma

bowesmana
SplunkTrust
SplunkTrust

I came across this today 

Seems to be a problem with having Enterprise Security installed with a truncate macro defined with 

validation = isint(length) AND length>=0

but it's mixing the args defined in the app exporter of the same name  with the validation expression from SA-Utils, but of course the args are different - App exporter uses n for length, so if you change the macro, which shows in the GUI to be the app exporter one, and replace length with field, the macro of course works.

 

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Also unlikely - you mentioned you modified the expression, that creates a copy in local.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Sounds a lot like a different app has defined a globally shared macro of the same name, with clashing parameter validations.
Check your environment for a second truncate(2) macro to narrow that down.

0 Karma

gokadroid
Motivator

length (arg2) must be an integer greater than or equal to zero. must be coming from the Validation Error Message you have put for the Validation Expression of macro definition.

Can you check what are Validation Expression and Validation Error Message and if they are as per your requirement. You can check them by going to Settings » Advanced search » Search macros » yourMacro.

Also since calculating the length is for strings (generally) and in your case you are passing integer 150 as arg2 , so as a calculated guess, if everything else seems to be the way it should be, can you check if you have put in the len($arg2$) >= 0 as Validation Expression and try to tweak it to len(tostring($arg2$)) >=0 to see if it resolves it.

0 Karma

miteshp250283
Path Finder

The macro came with the app itself. 🙂
I will try to tweak the macro to see if it works.

0 Karma

miteshp250283
Path Finder

I took off the macro from the search that was powering the panel. Unsure why it was in place.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...