Getting Data In

Invalid XML returned from REST API

giraffe
Explorer

When I insert an event and call the "services/search/jobs/export" REST endpoint, the XML that comes back is malformed and breaks XML parsing. There is another empty results document appended after the end of the document. Here is an example (with some valid result elements elided).

Any idea what could be causing this and how to work around it? We're running Splunk 4.2.3 on Windows 32.

<?xml version='1.0' encoding='UTF-8'?>
<results preview='0'>
<meta>
<fieldOrder>
<field>_cd</field>
<field>_indextime</field>
<field>_raw</field>
<field>_serial</field>
<field>_si</field>
<field>_sourcetype</field>
<field>_subsecond</field>
<field>_time</field>
<field>host</field>
<field>index</field>
<field>linecount</field>
<field>source</field>
<field>sourcetype</field>
<field>splunk_server</field>
</fieldOrder>
</meta>
<messages>
  <msg type="DEBUG">base lispy: [ AND group ]</msg>
  <msg type="DEBUG">search context: user="admin", app="search", bs-pathname="C:\splunk\etc"</msg>
</messages>
<result offset='0'>
    <field k='_cd'>
        <value><text>1:51</text></value>
    </field>
    <field k='_indextime'>
        <value><text>1320939650</text></value>
    </field>
    <field k='_raw'><v xml:space='preserve' trunc='0'>1320939650437 event-type=&quot;Test&quot; component=&quot;Job Controller&quot; giraffe-server=&quot;wlon1907051257&quot; <sg h='1'>group</sg>=&quot;cd290e81-75ca-4df6-b3e2-896d8085dc7b&quot; sequence=&quot;1&quot;</v></field>
    <field k='_serial'>
        <value><text>0</text></value>
    </field>
    <field k='_si'>
        <value><text>wlon1907051257</text></value>
        <value><text>main</text></value>
    </field>
    <field k='_sourcetype'>
        <value><text>giraffe-audit</text></value>
    </field>
    <field k='_subsecond'>
        <value><text>.437</text></value>
    </field>
    <field k='_time'>
        <value><text>2011-11-10 15:40:50.437 GMT Standard Time</text></value>
    </field>
    <field k='host'>
        <value><text>localhost</text></value>
    </field>
    <field k='index'>
        <value><text>main</text></value>
    </field>
    <field k='linecount'>
        <value><text>1</text></value>
    </field>
    <field k='source'>
        <value><text>giraffe-localdev</text></value>
    </field>
    <field k='sourcetype'>
        <value><text>giraffe-audit</text></value>
    </field>
    <field k='splunk_server'>
        <value><text>wlon1907051257</text></value>
    </field>
</result>
<result offset='1'>
        ....
</result>
</results>
<results preview='0'>
<meta>
<fieldOrder />
</meta>
</results>
<results preview='0'>
<meta>
<fieldOrder />
</meta>
</results>
<results preview='0'>
<meta>
<fieldOrder />
</meta>
</results>
Tags (5)
1 Solution

giraffe
Explorer

Post to services/search/jobs and set the exec_mode parameter to "oneshot". That will return the results in a single document, not a malformed stream of multiple documents.

View solution in original post

giraffe
Explorer

Post to services/search/jobs and set the exec_mode parameter to "oneshot". That will return the results in a single document, not a malformed stream of multiple documents.

giraffe
Explorer

I've upgraded to version 4.2.4 and still have the same issue.

0 Karma
Get Updates on the Splunk Community!

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...