Getting Data In

Why doesn't my REST query to /services/authentication/users work anymore all of a sudden?

JuGuSm
Path Finder

Hi,

I use this query almost every day :

| rest /services/authentication/users

But today it doesn't work, I get this error message :

Failed to parse XML Body:<?xml version="1.0" encoding="UTF-8"?> <!--This is to override b...

And I don't have the end of this message.

Other rest commands work fine.

Tags (2)
1 Solution

scorrie_splunk
Splunk Employee
Splunk Employee

I just had a case with the exact error. It turned out to be related to Splunk's inability to process the data due to some issue in the data.

In the case I worked on, there were base64 VALUES that had a hidden character at the beginning.

I am aware of one other case, which had unusual (not UTF-8) characters in the data.

Solution:
Fix your data. Examine it with a programming Tool (I use MacVIM, and GVIM). You may not see the problem when just looking at the logs.

If you can't fix your data prior to ingestion, what you can do is go into the search.log, determine which search (or source) is generating the problem and disable it. I realize this is a temporary solution, but it is a workaround until you can clean up your data.

I was not able to find any "Splunk Bugs" on this particular issue, possibly because it falls more under "quality of incoming data".

View solution in original post

scorrie_splunk
Splunk Employee
Splunk Employee

I just had a case with the exact error. It turned out to be related to Splunk's inability to process the data due to some issue in the data.

In the case I worked on, there were base64 VALUES that had a hidden character at the beginning.

I am aware of one other case, which had unusual (not UTF-8) characters in the data.

Solution:
Fix your data. Examine it with a programming Tool (I use MacVIM, and GVIM). You may not see the problem when just looking at the logs.

If you can't fix your data prior to ingestion, what you can do is go into the search.log, determine which search (or source) is generating the problem and disable it. I realize this is a temporary solution, but it is a workaround until you can clean up your data.

I was not able to find any "Splunk Bugs" on this particular issue, possibly because it falls more under "quality of incoming data".

View solution in original post

JuGuSm
Path Finder

My problem has been resolved a few months ago and it was exactly what you described.

0 Karma

effem
Communicator

Hey guys,

how have you been able to fix this?

I have the same issue with
| rest splunk_server=local /services/search/jobs

Can't find a safe way to find the malicious characters, although splunk is stating its this:
Entity: line 305799: parser: Input is not proper UTF-8, indicate encoding !\nBytes: 0xC3 0x20 0x2E 0x2E

0 Karma

mbrettschneider
Engager

Same problem for me with
| REST /services/data/lookup-table-files

 | rest /services/authentication/users

works for me.

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!