Why is REST API job/search returning "text/plain" as a message type?

[Lowell]

Has anyone had any issues with the REST API returning text/plain as a message type in a response message?

I've seen this happen a few times over the last couple of months, and have been assuming that it was a bug in my implementation, but after looking closer it appears that the issue may be coming from a weird response message coming back from splunkd.

Basically, my process does the following:

1. Authenticate with splunkd to get an auth token.
2. Submit a search request.
3. Query the search job. Wait for the job to be done or finalized, otherwise sleep and poll again.
4. Fetch the results of the job.

This error is happening on step 3. The URL is https://splunk.mydomain.com:8089/services/search/job/sid

Here's the actual response message I'm seeing:

<?xml version='1.0' encoding='UTF-8'?>
<response><messages><msg type='text/plain'></msg></messages></response>

My code is expecting that any <msg> coming back from splunk to have a type of "DEBUG", "INFO", "WARN", or "ERROR" so the type of "text/plain" raises an exception.

I'm still in the process of investigating this on my end, but I was wondering if anyone else had see anything like this. I'm attempting to increase the amount of debug information I'm capturing during a failure, but since this is rather sporadic, it could be a while until it happens again. (It seems a bit early to file a bug since at this point I don't have anything reproducible or specific details about the timing, or even the sid of the search job that returned the weird message.)

Any ideas?

---

Update:

I've done some more digging on my end, and determined that I seem to be getting a msg type of "text/plain" only when the HTTP response status is 204 (No Content). I was also able to capture a literal XML string returned by the splunkd process, so I updated the example above accordingly.

[Lowell · Accepted solution]

Quick update (so I can "answer" this question)

The integration platform I'm using issued the following bug fix in regards to the "204" response code:

1-1W397J (IS_7-1-2_SrvPrtcl_Fix3)
The pub.client:http built-in service is not properly handling
response 204 from a client.

I've applied the fix, and haven't seen any evidence of this issue in quite some time. (I also added a special exception for "text/plain", so that it simply logs the issue rather than crashing.) So I'm assuming this was some weird fluke until I see something suggesting otherwise.

[bhushannbagad]

Hi

Kindly please let me know the fix for this issue