Splunk Dev

splunk rejects geo macro

natestelladot
Engager

I have the google maps application for splunk and configured geo location on it, and it works fine (search | geoip ip_address returns stuff). However when I try to configure web analytics with this app splunk rejects the data input.

What I think I should put in is

| geoip ip_address

but no matter what variation I try (quotes, no quotes etc) Splunk always barfs. Sample error from log

09-19-2011 19:10:34.896 +0000 ERROR AdminManager - Unexpected error "<class 'splunk.BadRequest'>" from python handler: "[HTTP 400] Bad Request; [{'text': 'In handler \'macros\': Argument "disabled" is not supported by this handler.', 'code': None, 'type': 'ERROR'}]".  See splunkd.log for more details.
09-19-2011 19:13:58.251 +0000 ERROR AdminManager - Stack trace from python handler:
Traceback (most recent call last):
  File "/opt/splunk/lib/python2.6/site-packages/splunk/admin.py", line 60, in init
    hand.execute(info)
  File "/opt/splunk/lib/python2.6/site-packages/splunk/admin.py", line 433, in execute
    if self.requestedAction == ACTION_EDIT:     self.handleEdit(confInfo)
  File "/opt/splunk/etc/apps/web_analytics/bin/sideview_wa_setup_handler.py", line 66, in handleEdit
    en.setEntity(macro,sessionKey=sessionKey)
  File "/opt/splunk/lib/python2.6/site-packages/splunk/entity.py", line 308, in setEntity
    serverResponse, serverContent = rest.simpleRequest(uri, sessionKey=sessionKey, postargs=postargs, raiseAllErrors=True)
  File "/opt/splunk/lib/python2.6/site-packages/splunk/rest/__init__.py", line 468, in simpleRequest
    raise splunk.BadRequest, (None, serverResponse.messages)
BadRequest: [HTTP 400] Bad Request; [{'text': 'In handler \'macros\': Argument "disabled" is not supported by this handler.', 'code': None, 'type': 'ERROR'}]

The configuration screen mentions pasting one of the quote characters incorrectly, however I see no quote characters.

Running Splunk 4.2.1, and I downloaded this web analytics application last week.

Tags (1)

natestelladot
Engager

this problem went away when I upgraded to splunk 4.2.3

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Cisco Data Fabric from Architecture to Investigation, Better SOC Visibility, and More ...

Splunk Lantern is Splunk’s customer success center that provides practical guidance from Splunk experts on key ...

The Trust Gap: Why a Data Foundation is Fundamental to an Agentic Enterprise

The Trust Gap: Why a data foundation is fundamental to an  Agentic Enterprise.   Agentic AI is transforming ...

Data Management Digest – September 2026

    Welcome to the September 2026 edition of Data Management Digest! September brought a fresh wave of ...