I have the google maps application for splunk and configured geo location on it, and it works fine (search | geoip ip_address returns stuff). However when I try to configure web analytics with this app splunk rejects the data input.
What I think I should put in is
| geoip ip_address
but no matter what variation I try (quotes, no quotes etc) Splunk always barfs. Sample error from log
09-19-2011 19:10:34.896 +0000 ERROR AdminManager - Unexpected error "<class 'splunk.BadRequest'>" from python handler: "[HTTP 400] Bad Request; [{'text': 'In handler \'macros\': Argument "disabled" is not supported by this handler.', 'code': None, 'type': 'ERROR'}]". See splunkd.log for more details.
09-19-2011 19:13:58.251 +0000 ERROR AdminManager - Stack trace from python handler:
Traceback (most recent call last):
File "/opt/splunk/lib/python2.6/site-packages/splunk/admin.py", line 60, in init
hand.execute(info)
File "/opt/splunk/lib/python2.6/site-packages/splunk/admin.py", line 433, in execute
if self.requestedAction == ACTION_EDIT: self.handleEdit(confInfo)
File "/opt/splunk/etc/apps/web_analytics/bin/sideview_wa_setup_handler.py", line 66, in handleEdit
en.setEntity(macro,sessionKey=sessionKey)
File "/opt/splunk/lib/python2.6/site-packages/splunk/entity.py", line 308, in setEntity
serverResponse, serverContent = rest.simpleRequest(uri, sessionKey=sessionKey, postargs=postargs, raiseAllErrors=True)
File "/opt/splunk/lib/python2.6/site-packages/splunk/rest/__init__.py", line 468, in simpleRequest
raise splunk.BadRequest, (None, serverResponse.messages)
BadRequest: [HTTP 400] Bad Request; [{'text': 'In handler \'macros\': Argument "disabled" is not supported by this handler.', 'code': None, 'type': 'ERROR'}]
The configuration screen mentions pasting one of the quote characters incorrectly, however I see no quote characters.
Running Splunk 4.2.1, and I downloaded this web analytics application last week.
