Security

AttributeError: 'str' object has no attribute 'os_startIndex' on Splunk 6.2.1 on RedHat

ksim777
Engager

When I clicked on Splunkenterprise/Settings/Lookup/LookupDefinitions
I have error
500 Internal Server Error
Return to Splunk home page
AttributeError: 'str' object has no attribute 'os_startIndex'
View more information about your request (request ID = xxxxx ) in Search
This page was linked to from https://servername:8000/en-AU/manager/search/lookups

I tried https://servername:8000/en-AU/debug/refresh.... (not working)
and it gives....
Refreshing admin/alert_actions OK
Refreshing admin/clusterconfig OK
Refreshing admin/collections-conf BadRequest
In handler 'collections-conf': Must use user context of 'nobody' when interacting with collection configurations (used user='ksim')
Refreshing admin/commandsconf OK
Refreshing admin/conf-deploymentclient OK
Refreshing admin/conf-inputs OK
Refreshing admin/conf-times OK
...
..
Refreshing admin/scheduledviews OK
Refreshing admin/script OK
Refreshing admin/serverclasses InternalServerError
In handler 'serverclasses': serverclass='_reload' not found
Refreshing admin/shclusterconfig OK
Refreshing admin/sourcetypes OK
Refreshing admin/ssl OK
Refreshing admin/syslog OK
Refreshing admin/tcpout-default OK
Refreshing admin/tcpout-group OK
Refreshing admin/tcpout-server OK
Refreshing admin/transforms-extract OK
Refreshing admin/transforms-lookup AttributeError 'str' object has no attribute 'os_startIndex'
Refreshing admin/transforms-reload ResourceNotFound
In handler 'transforms-reload': Invalid action for this internal handler (handler: transforms-reload, supported: list|_reload, wanted: list).
Refreshing admin/udp OK
Refreshing admin/ui-prefs OK
Refreshing admin/ui-tour OK

Tags (1)

Gibbo87
Explorer

Hi,

I just encountered the same issue. In my case the header of a lookup had some special characters like "à". Removing those characters from the header and doing a debug refresh solved the issue.

The complex part is to identify which lookup has the wrong header.

0 Karma

ksim777
Engager

From Debug :-
File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/controllers/admin.py", line 1741, in listEntities
entities = en.getEntities(endpoint_path, **args)
File "/opt/splunk/lib/python2.7/site-packages/splunk/entity.py", line 131, in getEntities
offset = int(atomFeed.os_startIndex or -1)
AttributeError: 'str' object has no attribute 'os_startIndex'

Can anyone gives me tips how to go about solving this error ?
Have tried set timezone , as suggested in other website.. it didn't help

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Event Series May & June: From Network Visibility to Service Intelligence

Unifying the Network: Moving from Alert Noise to Service Intelligence with Splunk ITSI In today’s hybrid ...

Global Splunk User Group Events: May + June 2026

Your Splunk Community Awaits: Discover Upcoming User Group Events Worldwide    Staying ahead in the fast-paced ...

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas     Cisco Live 2026 is almost here, and this ...