Splunk Dev

Exception when i try to extract fields in the web interface

dkerwin
Engager

No matter on what message i try to extract fileds i end up with a short Python exception (Error 500):

AttributeError: 'str' object has no attribute 'toPrimitive'

Here's the full exception:

2010-10-14 14:44:00,261 INFO    [4cb6fb0ef723b24d0] FieldLearning:56 - GENERATING RULES FROM 100 EVENTS
2010-10-14 14:44:00,994 WARNING [4cb6fb0ef723b24d0] format:47 - There was an error parsing the feed document. Error: PCDATA invalid Char value 27, line 24899, column 44
2010-10-14 14:44:00,995 INFO    [4cb6fb0ef723b24d0] _cplogging:55 - [14/Oct/2010:14:44:00] HTTP 
Request Headers:
  REFERER: http://172.20.50.235:8000/en-US/app/search/flashtimeline?q=search%20*
  HOST: 172.20.50.235:8000
  ACCEPT: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
  ACCEPT-CHARSET: ISO-8859-1,utf-8;q=0.7,*;q=0.3
  USER-AGENT: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_4; en-US) AppleWebKit/534.3 (KHTML, like Gecko) Chrome/6.0.472.63 Safari/534.3
  CONNECTION: keep-alive
  COOKIE: session_id_8000=d350af526b47d6a37201356333c4206785356e8e
  Remote-Addr: 172.20.50.105
  ACCEPT-LANGUAGE: en-US,en;q=0.8
  ACCEPT-ENCODING: gzip,deflate,sdch
2010-10-14 14:44:00,995 DEBUG   [4cb6fb0ef723b24d0] _cplogging:55 - [14/Oct/2010:14:44:00] HTTP Traceback (most recent call last):
  File "/data/splunk/lib/python2.6/site-packages/cherrypy/_cprequest.py", line 606, in respond
    cherrypy.response.body = self.handler()
  File "/data/splunk/lib/python2.6/site-packages/cherrypy/_cpdispatch.py", line 25, in __call__
    return self.callable(*self.args, **self.kwargs)
  File "/data/splunk/lib/python2.6/site-packages/splunk/appserver/mrsparkle/lib/routes.py", line 307, in default
    return route.target(self, **kw)
  File "<string>", line 1, in <lambda>
  File "/data/splunk/lib/python2.6/site-packages/splunk/appserver/mrsparkle/lib/decorators.py", line 38, in rundecs
    return fn(*a, **kw)
  File "<string>", line 1, in <lambda>
  File "/data/splunk/lib/python2.6/site-packages/splunk/appserver/mrsparkle/lib/decorators.py", line 93, in check
    return fn(self, *a, **kw)
  File "<string>", line 1, in <lambda>
  File "/data/splunk/lib/python2.6/site-packages/splunk/appserver/mrsparkle/lib/decorators.py", line 141, in validate_ip
    return fn(self, *a, **kw)
  File "<string>", line 1, in <lambda>
  File "/data/splunk/lib/python2.6/site-packages/splunk/appserver/mrsparkle/lib/decorators.py", line 275, in preform_sso_check
    return fn(self, *a, **kw)
  File "<string>", line 1, in <lambda>
  File "/data/splunk/lib/python2.6/site-packages/splunk/appserver/mrsparkle/lib/decorators.py", line 312, in check_login
    return fn(self, *a, **kw)
  File "<string>", line 1, in <lambda>
  File "/data/splunk/lib/python2.6/site-packages/splunk/appserver/mrsparkle/lib/decorators.py", line 333, in handle_exceptions
    return fn(self, *a, **kw)
  File "/data/splunk/lib/python2.6/site-packages/splunk/appserver/mrsparkle/controllers/ifx.py", line 97, in index
    if not fieldNameExtractionExists(args, regex):
  File "/data/splunk/lib/python2.6/site-packages/splunk/appserver/mrsparkle/controllers/ifx.py", line 414, in fieldNameExtractionExists
    props = bundle.getConf('props', sessionkey, namespace, owner)
  File "/data/splunk/lib/python2.6/site-packages/splunk/bundle.py", line 46, in getConf
    stanzas = confFeed.toPrimitive()
AttributeError: 'str' object has no attribute 'toPrimitive'

Thanks

Daniel

Tags (1)

ftk
Motivator

I recommend contacting Splunk support about this issue.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...