Job Management Dashboard not Functional 'str' object has no attribute 'os_startIndex'

[dflodstrom]

I am receiving the following error when attempting to view the job management dashboard from my clustered search heads:
[JobManager module] 'str' object has no attribute 'os_startIndex'
We have recently upgraded to Splunk version 6.2.3, this has been an issue since the upgrade. Any suggestions will help.

[bohanlon_splunk]

Did this workaround have the desired affect?
https://answers.splunk.com/answers/37892/500-internal-server-error-str-object-has-no-attribute-os-st...

[dflodstrom]

The previous answer did not permanently fix my issue. Splunk support says upgrading to the latest version, 6.2.4, should fix this issue. I haven't tested this upgrade yet, I'll accept this answer when I confirm.

[kikexclusive]

This issue was not resolved neither in 6.3.0 Splunk Enterprise version... anyone knows how to fix it?

[dflodstrom]

I apologize for not circling back after I resolved this issue. I worked with support to fix this and they should have fixed this in later releases.

The issue was with this python script: lib/python2.7/site-packages/httplib2/init.py.org

I would provide the change to you but I'm not sure if the workaround we applied is 1. appropriate to share or 2. the correct way to resolve this long-term.

If you're able to update you can try that or reach out to support. I worked with Masaaki Yana on this case.

[jonathan_cooper]

Hi Dave, long time no talk! (It's Cooper, your PS guy)

I'm on a current engagement with another customer on 6.3.3 and see this issue still. 😞

[dflodstrom]

Terrible. You've got mail.

[dflodstrom]

This issue was not resolved in version 6.2.4. It has been added to the list of known issues in that version. I'm testing 6.2.5 now which should fix this issue. Should.

[dflodstrom]

This is still an issue for us in version 6.2.5

[dflodstrom]

After upgrading to 6.2.3 this was only an issue on my search head cluster. All other Splunk instances displayed the dashboard without an issue. Adding the following to $SPLUNK_HOME/etc/system/local/limits.conf fixed it

[restapi]
jobscontentmaxcount = 100

The default value for this parameter in limits.conf is 0:

jobscontentmaxcount = <integer>
* Maximum length of a property in the contents dictionary of an entry from /jobs getter from REST API
* Value of 0 disables truncation
* Defaults to 0