I installed the App Exporter on Splunk Enterprise 6.5.0. While launching the app, the dashboard shows this message:
Error in 'SearchParser': Encountered the following error while validating macro 'truncate(description, 150)': length (arg2) must be an integer greater than or equal to zero.
This message shows up with admin
as well as power
roles.
Please suggest if I need to change any settings or provide additional capabilities to the roles/user.
Thanks, Mitesh.
I just ran into this same problem with app exporter version 1.1. The truncate(2) macro that comes with the app exporter references the length variable as $n$, but uses the term length in the validation expression. Update the validation expression to read "isint(n) AND n>=0" and it should work.
Thank you @cyrix . This worked for me.
Again, you likely have a different app installed that shares a macro of the same name globally, resulting in their validation expression being used with the App Exporter macro - and if they use different variables then errors will happen.
Hi Martin, thanks for your response. I did verify this. SA-utils has a global truncate(2) macro. However, I disabled this macro for testing without success. Updating the validation expression for the truncate(2) macro in the app_exporter context is what fixed this error for me.
That's highly unlikely, considering the App Exporter doesn't ship any validation expression.
It must be a bug in Splunk. This particular search head is running 6.5.0. I confirmed there is no validation expression shipped with App Exporter in my personal dev environment. The validation expression I found in the truncate(2) macro under the App Exporter context was identical to the validation expression used by SA-utils, although the eval was different.
I came across this today
Seems to be a problem with having Enterprise Security installed with a truncate macro defined with
validation = isint(length) AND length>=0
but it's mixing the args defined in the app exporter of the same name with the validation expression from SA-Utils, but of course the args are different - App exporter uses n for length, so if you change the macro, which shows in the GUI to be the app exporter one, and replace length with field, the macro of course works.
Also unlikely - you mentioned you modified the expression, that creates a copy in local.
Sounds a lot like a different app has defined a globally shared macro of the same name, with clashing parameter validations.
Check your environment for a second truncate(2)
macro to narrow that down.
length (arg2) must be an integer greater than or equal to zero.
must be coming from the Validation Error Message
you have put for the Validation Expression
of macro definition.
Can you check what are Validation Expression
and Validation Error Message
and if they are as per your requirement. You can check them by going to Settings » Advanced search » Search macros » yourMacro
.
Also since calculating the length is for strings (generally) and in your case you are passing integer 150
as arg2
, so as a calculated guess, if everything else seems to be the way it should be, can you check if you have put in the len($arg2$) >= 0
as Validation Expression
and try to tweak it to len(tostring($arg2$)) >=0
to see if it resolves it.
The macro came with the app itself. 🙂
I will try to tweak the macro to see if it works.
I took off the macro from the search that was powering the panel. Unsure why it was in place.