Getting Data In
Highlighted

Invalid XML returned from REST API

Explorer

When I insert an event and call the "services/search/jobs/export" REST endpoint, the XML that comes back is malformed and breaks XML parsing. There is another empty results document appended after the end of the document. Here is an example (with some valid result elements elided).

Any idea what could be causing this and how to work around it? We're running Splunk 4.2.3 on Windows 32.

<?xml version='1.0' encoding='UTF-8'?>
<results preview='0'>
<meta>
<fieldOrder>
<field>_cd</field>
<field>_indextime</field>
<field>_raw</field>
<field>_serial</field>
<field>_si</field>
<field>_sourcetype</field>
<field>_subsecond</field>
<field>_time</field>
<field>host</field>
<field>index</field>
<field>linecount</field>
<field>source</field>
<field>sourcetype</field>
<field>splunk_server</field>
</fieldOrder>
</meta>
<messages>
  <msg type="DEBUG">base lispy: [ AND group ]</msg>
  <msg type="DEBUG">search context: user="admin", app="search", bs-pathname="C:\splunk\etc"</msg>
</messages>
<result offset='0'>
    <field k='_cd'>
        <value><text>1:51</text></value>
    </field>
    <field k='_indextime'>
        <value><text>1320939650</text></value>
    </field>
    <field k='_raw'><v xml:space='preserve' trunc='0'>1320939650437 event-type=&quot;Test&quot; component=&quot;Job Controller&quot; giraffe-server=&quot;wlon1907051257&quot; <sg h='1'>group</sg>=&quot;cd290e81-75ca-4df6-b3e2-896d8085dc7b&quot; sequence=&quot;1&quot;</v></field>
    <field k='_serial'>
        <value><text>0</text></value>
    </field>
    <field k='_si'>
        <value><text>wlon1907051257</text></value>
        <value><text>main</text></value>
    </field>
    <field k='_sourcetype'>
        <value><text>giraffe-audit</text></value>
    </field>
    <field k='_subsecond'>
        <value><text>.437</text></value>
    </field>
    <field k='_time'>
        <value><text>2011-11-10 15:40:50.437 GMT Standard Time</text></value>
    </field>
    <field k='host'>
        <value><text>localhost</text></value>
    </field>
    <field k='index'>
        <value><text>main</text></value>
    </field>
    <field k='linecount'>
        <value><text>1</text></value>
    </field>
    <field k='source'>
        <value><text>giraffe-localdev</text></value>
    </field>
    <field k='sourcetype'>
        <value><text>giraffe-audit</text></value>
    </field>
    <field k='splunk_server'>
        <value><text>wlon1907051257</text></value>
    </field>
</result>
<result offset='1'>
        ....
</result>
</results>
<results preview='0'>
<meta>
<fieldOrder />
</meta>
</results>
<results preview='0'>
<meta>
<fieldOrder />
</meta>
</results>
<results preview='0'>
<meta>
<fieldOrder />
</meta>
</results>
Tags (5)
Highlighted

Re: Invalid XML returned from REST API

Explorer

I've upgraded to version 4.2.4 and still have the same issue.

0 Karma
Highlighted

Re: Invalid XML returned from REST API

Explorer

Post to services/search/jobs and set the exec_mode parameter to "oneshot". That will return the results in a single document, not a malformed stream of multiple documents.

View solution in original post