Distributed search error on GUI configuration: entry not saved

[landen99]

After entering the search peer information into the Distributed Search-Add search peers window, I get the following error:

Your entry was not saved. The following error was reported: SyntaxError: Unexpected token < in JSON at position 0.

My URI is:
https://192.168.###.###:8089

Then when I try to search "index=_internal sourcetype=splunkd error | head 99", I get the error:

Splunk cannot authenticate the request. CSRF validation failed.

What could the issue be and how should I troubleshoot this one?

A quick note about my server.conf in etc\system\local, the current setting is:

[sslConfig]
enableSplunkdSSL = false
sslPassword = $1$MhI5x3Z+VX7R

Splunk keeps adding sslpassword even though I have enable splunkdssl set to false, despite stopping splunk to edit the file. At one point, I tried encryption and tried to back out of it when it didn't work as I had expected.

[deepashri_123]

Hi @ landen99,

Can u help with how u addressed the second CSRF issue ? I am facing a similar issue.

[landen99]

Both SH and IDX must be set to either encrypt or not.

[deepashri_123]

Thanks!!!

[jkat54]

Did you see this answer about browser plugins?

Ref: https://answers.splunk.com/answers/247389/cant-add-input-for-rest-ta-your-entry-was-not-save-1.html

I think I got this error once and I went into the DMC setup page and without making any changes, clicked on save configuration and it fixed the problem.

[woodcock]

I don't know about the 2nd error, but the first one is a bug which is easily worked-around:
https://answers.splunk.com/answers/106487/your-entry-was-not-saved-the-following-error-was-r.html

[landen99]

There is no search involved here. What do you mean?