Security

AttributeError: 'str' object has no attribute 'os_startIndex' on Splunk 6.2.1 on RedHat

ksim777
Engager

When I clicked on Splunkenterprise/Settings/Lookup/LookupDefinitions
I have error
500 Internal Server Error
Return to Splunk home page
AttributeError: 'str' object has no attribute 'os_startIndex'
View more information about your request (request ID = xxxxx ) in Search
This page was linked to from https://servername:8000/en-AU/manager/search/lookups

I tried https://servername:8000/en-AU/debug/refresh.... (not working)
and it gives....
Refreshing admin/alert_actions OK
Refreshing admin/clusterconfig OK
Refreshing admin/collections-conf BadRequest
In handler 'collections-conf': Must use user context of 'nobody' when interacting with collection configurations (used user='ksim')
Refreshing admin/commandsconf OK
Refreshing admin/conf-deploymentclient OK
Refreshing admin/conf-inputs OK
Refreshing admin/conf-times OK
...
..
Refreshing admin/scheduledviews OK
Refreshing admin/script OK
Refreshing admin/serverclasses InternalServerError
In handler 'serverclasses': serverclass='_reload' not found
Refreshing admin/shclusterconfig OK
Refreshing admin/sourcetypes OK
Refreshing admin/ssl OK
Refreshing admin/syslog OK
Refreshing admin/tcpout-default OK
Refreshing admin/tcpout-group OK
Refreshing admin/tcpout-server OK
Refreshing admin/transforms-extract OK
Refreshing admin/transforms-lookup AttributeError 'str' object has no attribute 'os_startIndex'
Refreshing admin/transforms-reload ResourceNotFound
In handler 'transforms-reload': Invalid action for this internal handler (handler: transforms-reload, supported: list|_reload, wanted: list).
Refreshing admin/udp OK
Refreshing admin/ui-prefs OK
Refreshing admin/ui-tour OK

Tags (1)

Gibbo87
Explorer

Hi,

I just encountered the same issue. In my case the header of a lookup had some special characters like "à". Removing those characters from the header and doing a debug refresh solved the issue.

The complex part is to identify which lookup has the wrong header.

0 Karma

ksim777
Engager

From Debug :-
File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/controllers/admin.py", line 1741, in listEntities
entities = en.getEntities(endpoint_path, **args)
File "/opt/splunk/lib/python2.7/site-packages/splunk/entity.py", line 131, in getEntities
offset = int(atomFeed.os_startIndex or -1)
AttributeError: 'str' object has no attribute 'os_startIndex'

Can anyone gives me tips how to go about solving this error ?
Have tried set timezone , as suggested in other website.. it didn't help

0 Karma
Get Updates on the Splunk Community!

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...

Splunk Up Your Game: Why It's Time to Embrace Python 3.9+ and OpenSSL 3.0

Did you know that for Splunk Enterprise 9.4, Python 3.9 is the default interpreter? This shift is not just a ...