Splunk Search

An error occurred while reading the page template. See web_service.log for more details

perlish
Communicator

How can I solve the problem ?
Thank you !

[root@only144 splunk]# netstat -antpl | grep 8089
tcp 0 0 0.0.0.0:8089 0.0.0.0:* LISTEN 22068/splunkd

tcp 0 0 127.0.0.1:8089 127.0.0.1:53208 TIME_WAIT -

tcp 0 0 127.0.0.1:8089 127.0.0.1:53206 TIME_WAIT -

[root@only144 splunk]# tail -f var/log/splunk/web_service.log
2012-08-08 16:54:57,260 INFO [50222961417fde7c0ccd10] cached:77 - memoized decorator used on function with non hashable arguments
2012-08-08 16:54:58,070 ERROR [50222961417fde7c0ccd10] config:81 - [HTTP 403] Client is not authorized to perform requested action; https://127.0.0.1:8089/services/search/timeparser/tz
Traceback (most recent call last):
File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/lib/config.py", line 79, in getServerZoneInfo
return times.getServerZoneinfo()
File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/lib/times.py", line 158, in getServerZoneinfo
serverStatus, serverResp = splunk.rest.simpleRequest('/search/timeparser/tz')
File "/opt/splunk/lib/python2.7/site-packages/splunk/rest/init.py", line 436, in simpleRequest
raise splunk.AuthorizationFailed(extendedMessages=uri)
AuthorizationFailed: [HTTP 403] Client is not authorized to perform requested action; https://127.0.0.1:8089/services/search/timeparser/tz
2012-08-08 16:54:58,087 ERROR [50222961417fde7c0ccd10] init:267 - Mako failed to render:

Traceback (most recent call last):
File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/controllers/init.py", line 265, in render_template
return templateInstance.render(*template_args)
File "/opt/splunk/lib/python2.7/site-packages/mako/template.py", line 283, in render
return runtime.render(self, self.callable, args, data)
File "/opt/splunk/lib/python2.7/site-packages/mako/runtime.py", line 575, in _render
*
kwargs_for_callable(callable, data))
File "/opt/splunk/lib/python2.7/site-packages/mako/runtime.py", line 607, in render_context
_exec_template(inherit, lclcontext, args=args, kwargs=kwargs)
File "/opt/splunk/lib/python2.7/site-packages/mako/runtime.py", line 633, in _exec_template
callable
(context, *args, **kwargs)
File "/opt/splunk/share/splunk/search_mrsparkle/templates/layout/base.html", line 10, in render_body
<%self:render/>
File "/opt/splunk/share/splunk/search_mrsparkle/templates/layout/base.html", line 25, in render_render
##
File "/opt/splunk/share/splunk/search_mrsparkle/templates/layout/base.html", line 67, in render_pagedoc
% else:
File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/lib/config.py", line 103, in getConfig
args.update(get_app_config(namespace))
File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/lib/config.py", line 48, in _get_app_config
rawConfig = splunk.bundle.getConf('app', namespace=app)
File "/opt/splunk/lib/python2.7/site-packages/splunk/bundle.py", line 39, in getConf
serverResponse, serverContent = rest.simpleRequest(uri, getargs={'fillcontents':1}, sessionKey=sessionKey)
File "/opt/splunk/lib/python2.7/site-packages/splunk/rest/
init_.py", line 436, in simpleRequest
raise splunk.AuthorizationFailed(extendedMessages=uri)
AuthorizationFailed: [HTTP 403] Client is not authorized to perform requested action; https://127.0.0.1:8089/servicesNS/admin/search/properties/app?fillcontents=1

2012-08-08 16:54:58,089 WARNING [50222961417fde7c0ccd10] init:259 - unable to obtain template=dashboard.html
^C
[root@only144 splunk]# cat > var/log/splunk/web_service.log

^C
[root@only144 splunk]# tail -f var/log/splunk/web_service.log
2012-08-08 16:55:41,046 INFO [5022298d0b7fde889668d0] cached:77 - memoized decorator used on function with non hashable arguments
2012-08-08 16:55:41,859 ERROR [5022298d0b7fde889668d0] config:81 - [HTTP 403] Client is not authorized to perform requested action; https://127.0.0.1:8089/services/search/timeparser/tz
Traceback (most recent call last):
File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/lib/config.py", line 79, in getServerZoneInfo
return times.getServerZoneinfo()
File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/lib/times.py", line 158, in getServerZoneinfo
serverStatus, serverResp = splunk.rest.simpleRequest('/search/timeparser/tz')
File "/opt/splunk/lib/python2.7/site-packages/splunk/rest/init.py", line 436, in simpleRequest
raise splunk.AuthorizationFailed(extendedMessages=uri)
AuthorizationFailed: [HTTP 403] Client is not authorized to perform requested action; https://127.0.0.1:8089/services/search/timeparser/tz
2012-08-08 16:55:41,875 ERROR [5022298d0b7fde889668d0] init:267 - Mako failed to render:

Traceback (most recent call last):
File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/controllers/init.py", line 265, in render_template
return templateInstance.render(*template_args)
File "/opt/splunk/lib/python2.7/site-packages/mako/template.py", line 283, in render
return runtime.render(self, self.callable, args, data)
File "/opt/splunk/lib/python2.7/site-packages/mako/runtime.py", line 575, in _render
*
kwargs_for_callable(callable, data))
File "/opt/splunk/lib/python2.7/site-packages/mako/runtime.py", line 607, in render_context
_exec_template(inherit, lclcontext, args=args, kwargs=kwargs)
File "/opt/splunk/lib/python2.7/site-packages/mako/runtime.py", line 633, in _exec_template
callable
(context, *args, **kwargs)
File "/opt/splunk/share/splunk/search_mrsparkle/templates/layout/base.html", line 10, in render_body
<%self:render/>
File "/opt/splunk/share/splunk/search_mrsparkle/templates/layout/base.html", line 25, in render_render
##
File "/opt/splunk/share/splunk/search_mrsparkle/templates/layout/base.html", line 67, in render_pagedoc
% else:
File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/lib/config.py", line 103, in getConfig
args.update(get_app_config(namespace))
File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/lib/config.py", line 48, in _get_app_config
rawConfig = splunk.bundle.getConf('app', namespace=app)
File "/opt/splunk/lib/python2.7/site-packages/splunk/bundle.py", line 39, in getConf
serverResponse, serverContent = rest.simpleRequest(uri, getargs={'fillcontents':1}, sessionKey=sessionKey)
File "/opt/splunk/lib/python2.7/site-packages/splunk/rest/
init_.py", line 436, in simpleRequest
raise splunk.AuthorizationFailed(extendedMessages=uri)
AuthorizationFailed: [HTTP 403] Client is not authorized to perform requested action; https://127.0.0.1:8089/servicesNS/admin/search/properties/app?fillcontents=1

2012-08-08 16:55:41,877 WARNING [5022298d0b7fde889668d0] init:259 - unable to obtain template=dashboard.html

mrenfr0
Explorer

The above helped me fix my problem as well. The role that the affected user was mapped to is supposed to inherit the base user account and tack on a few extra things. However, the inherited role went missing for reasons I'm still not clear on.

I had to edit $SPLUNK_HOME/etc/system/local/authorize.conf and re-add "importRoles = user" into the custom role I had, and that seems to have fixed the issue.

BenjaminWyatt
Communicator

This solved the problem. My admin was attempting to login with an account that had ONLY the can_delete role. This role has only the delete_by_keyword permission, which won't be enough to view pages (it's missing the rest_properties_get priv that is mentioned above). We logged in with an account that had both admin and can_delete and everything worked fine.

0 Karma

sideview
SplunkTrust
SplunkTrust

Oh. I have seen this error appear when the user is missing a key capability as well. However I'm pretty sure it had no relation to can_delete. Are you sure there aren't some other capabilities missing from the relevant role? And that can_delete is a red herring? I actually ran into this a few weeks ago and had to do binary-search debugging, adding half the capabilities back, restarting and testing, etc.... It was something weird like authorize.conf had turned off the rest_properties_get capability....

0 Karma

BenjaminWyatt
Communicator

It appears the solution Nick posted below might not help in my case - for me, all views work fine unless the user has the "can_delete" permissions. If the user has can_delete, however, ALL views throw this error message. So the best I can guess is that it has something to do with the permissions for that particular role, but I'm not sure where to begin looking.

0 Karma

sideview
SplunkTrust
SplunkTrust

There's a lot of disparate things that can trigger this error, and I know that at least some of them actually write nothing relevant to web_service.log. The best advice I can give is to back out changes on that view until it starts working again.

The one I can remember offhand, is one I've seen a few times, which is if you forget to have the <list> nodes around certain array-valued params, it'll give you this unhelpful error (and write nothing to web_service.log)

eg: In this simple statically defined Pulldown module, I've forgotten to put the little <list> nodes around the label and value in the staticOptions param. This will trigger the same error you're seeing.

<module name="Pulldown">
  <param name="name">user</param>
  <param name="label">User</param>
  <param name="staticOptions">
    <param name="label">Choose...</param>
    <param name="value"></param>
  </param>

So while it might have to do with some of the stuff in your log, it also might just be easier to do 'binary search debugging' on the view itself to figure out what it doesn't like -- delete half the view, but keep the markup valid, then hit /debug/refresh, then test. repeat, adding back deleted XML or deleting half of the remaining code as necessary until you get down to one line as the root-cause. It seems tedious but it'll give you the definitive cause of your bug in fewer than ten iterations.

LukeMurphey
Champion

What is the action the triggers this error? Is this error showing up in the user interface or when you go to a certain page or is this only noticed in the logs?

0 Karma

BenjaminWyatt
Communicator

Bump. Having the same errors, and would like to know if there's a resolution.

0 Karma

sysadminoftheda
Engager

Were you able to find the problem? Getting pretty much the same errors here.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...