Getting Data In

500 Internal Server Error out of splunklib/


I'm seeing this error message stream when the TA-ObserveIT tries to get what I think is the configuration information.

2020-04-16 16:29:33,418 ERROR pid=28982 tid=MainThread | Traceback (most recent call last):
  File "/splunk/hot/apps/splunk/etc/apps/TA-ObserveIT/bin/ta_observeit/modinput_wrapper/", line 113, in stream_events
  File "/splunk/hot/apps/splunk/etc/apps/TA-ObserveIT/bin/ta_observeit/modinput_wrapper/", line 152, in parse_input_args
  File "/splunk/hot/apps/splunk/etc/apps/TA-ObserveIT/bin/ta_observeit/modinput_wrapper/", line 171, in _parse_input_args_from_global_config
    ucc_inputs = global_config.inputs.load(input_type=self.input_type)
  File "/splunk/hot/apps/splunk/etc/apps/TA-ObserveIT/bin/ta_observeit/splunktaucclib/global_config/", line 270, in load
  File "/splunk/hot/apps/splunk/etc/apps/TA-ObserveIT/bin/ta_observeit/splunktaucclib/global_config/", line 175, in _load_endpoint
  File "/splunk/hot/apps/splunk/etc/apps/TA-ObserveIT/bin/ta_observeit/solnlib/packages/splunklib/", line 287, in wrapper
    return request_fun(self, *args, **kwargs)
  File "/splunk/hot/apps/splunk/etc/apps/TA-ObserveIT/bin/ta_observeit/solnlib/packages/splunklib/", line 69, in new_f
    val = f(*args, **kwargs)
  File "/splunk/hot/apps/splunk/etc/apps/TA-ObserveIT/bin/ta_observeit/solnlib/packages/splunklib/", line 665, in get
    response = self.http.get(path, self._auth_headers, **query)
  File "/splunk/hot/apps/splunk/etc/apps/TA-ObserveIT/bin/ta_observeit/solnlib/packages/splunklib/", line 1160, in get
    return self.request(url, { 'method': "GET", 'headers': headers })
  File "/splunk/hot/apps/splunk/etc/apps/TA-ObserveIT/bin/ta_observeit/solnlib/packages/splunklib/", line 1221, in request
    raise HTTPError(response)
HTTPError: HTTP 500 Internal Server Error -- {"messages":[{"type":"ERROR","text":"Unexpected error \"<class 'splunktaucclib.rest_handler.error.RestError'>\" from python handler: \"REST Error [400]: Bad Request -- HTTP 400 Bad Request -- Invalid Events Pagination Value: TypeError(\"int() argument must be a string or a number, not 'NoneType'\",)\".  See splunkd.log for more details."}]}

I've been trying to figure out a way of printing to the app or splunkd log files the request so I can see if that makes sense. The "Invalid Events Pagination Value: TypeError" doesn't make sense to me since the inputs.conf has this in it

events_pagination = 10000

I'm out of ideas. Any thoughts on how to resolve this are appreciated.


0 Karma
Get Updates on the Splunk Community!

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...

Security Newsletter Updates | March 2023

 March 2023 | Check out the latest and greatestUnify Your Security Operations with Splunk Mission Control The ...

Platform Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestIntroducing Splunk Edge Processor, simplified data ...