Reporting

Hadoop Connect - Scheduled Export Failure

bwmetz
New Member

I successfully created 65 different scheduled exports using Hadoop Connect without an error, but only 29 appear in the scheduled exports list. The remaining 36 all produce the following error when I attempt to re-add them. I checked HDFS and see the directories. Something seems messed up on the Splunk side.

2014-02-20 00:46:57,901 ERROR hdfs_export_handler.py [persistSavedSearch] [129] - Failed to save search object
Traceback (most recent call last):
  File "/opt/splunk_nfs/etc/apps/HadoopConnect/bin/hdfs_export_handler.py", line 126, in persistSavedSearch
    if not saved_search.save():
  File "/opt/splunk/lib/python2.7/site-packages/splunk/models/base.py", line 773, in save
    return self.create()
  File "/opt/splunk/lib/python2.7/site-packages/splunk/models/base.py", line 929, in create
    if super(SplunkAppObjModel, self).create():
  File "/opt/splunk/lib/python2.7/site-packages/splunk/models/base.py", line 758, in create
    newEntity = self.manager()._put_entity(new_endpoint, self.entity, messages, sessionKey=self.sessionKey)
  File "/opt/splunk/lib/python2.7/site-packages/splunk/models/base.py", line 520, in _put_entity
    return self._put_args(id, postargs, messages, sessionKey=sessionKey)
  File "/opt/splunk/lib/python2.7/site-packages/splunk/models/base.py", line 453, in _put_args
    serverResponse, serverContent = splunk.rest.simpleRequest(id, postargs=postargs, raiseAllErrors=True, sessionKey=sessionKey)
  File "/opt/splunk/lib/python2.7/site-packages/splunk/rest/__init__.py", line 553, in simpleRequest
    raise splunk.RESTException, (serverResponse.status, serverResponse.messages)
RESTException: [HTTP 409] [{'text': "In handler 'savedsearch': Unable to create saved search with name 'XYZ report'. A saved search with that name already exists.", 'type': 'ERROR', 'code': None}]

Has anyone run into this before? If so, how did you fix it? I don't see any CLI tools that might allow me to wipe these out and start again.

0 Karma

bosburn_splunk
Splunk Employee
Splunk Employee

It sounds like the other searches may of not finished.

If you have enterprise support, can you open a ticket up and message me the case number? I'm the SME for the Hadoop Connect stuff and can take a look at it.

Brian

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.