Splunk Dev

splunk rejects geo macro

natestelladot
Engager

I have the google maps application for splunk and configured geo location on it, and it works fine (search | geoip ip_address returns stuff). However when I try to configure web analytics with this app splunk rejects the data input.

What I think I should put in is

| geoip ip_address

but no matter what variation I try (quotes, no quotes etc) Splunk always barfs. Sample error from log

09-19-2011 19:10:34.896 +0000 ERROR AdminManager - Unexpected error "<class 'splunk.BadRequest'>" from python handler: "[HTTP 400] Bad Request; [{'text': 'In handler \'macros\': Argument "disabled" is not supported by this handler.', 'code': None, 'type': 'ERROR'}]".  See splunkd.log for more details.
09-19-2011 19:13:58.251 +0000 ERROR AdminManager - Stack trace from python handler:
Traceback (most recent call last):
  File "/opt/splunk/lib/python2.6/site-packages/splunk/admin.py", line 60, in init
    hand.execute(info)
  File "/opt/splunk/lib/python2.6/site-packages/splunk/admin.py", line 433, in execute
    if self.requestedAction == ACTION_EDIT:     self.handleEdit(confInfo)
  File "/opt/splunk/etc/apps/web_analytics/bin/sideview_wa_setup_handler.py", line 66, in handleEdit
    en.setEntity(macro,sessionKey=sessionKey)
  File "/opt/splunk/lib/python2.6/site-packages/splunk/entity.py", line 308, in setEntity
    serverResponse, serverContent = rest.simpleRequest(uri, sessionKey=sessionKey, postargs=postargs, raiseAllErrors=True)
  File "/opt/splunk/lib/python2.6/site-packages/splunk/rest/__init__.py", line 468, in simpleRequest
    raise splunk.BadRequest, (None, serverResponse.messages)
BadRequest: [HTTP 400] Bad Request; [{'text': 'In handler \'macros\': Argument "disabled" is not supported by this handler.', 'code': None, 'type': 'ERROR'}]

The configuration screen mentions pasting one of the quote characters incorrectly, however I see no quote characters.

Running Splunk 4.2.1, and I downloaded this web analytics application last week.

Tags (1)

natestelladot
Engager

this problem went away when I upgraded to splunk 4.2.3

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

SOK it to Me: Top 3 Benefits of Using Splunk Operator on Kubernetes that’ll Make ...

    Thursday, July 9, 2026  |  11:00AM–12:00PM PDT Duration: 1 hour (includes Q&A) Managing can feel like a ...

Upgrade Prep for 10.4, Network Observability Deep Dives, and More from Splunk Lantern

Splunk Lantern is Splunk’s customer success center that provides practical guidance from Splunk experts on key ...

Splunk Developer Day announcements: AI agents, MCP tools, Forecasting, and Custom ...

Splunk Developer Day was packed with product and platform updates for developers building in the AI ...