Splunk Search

Internal Server Error trying to retrieve search results from custom module

achung12
Explorer

When my module tries to retrieve results from a search launched by a user, it produces this error:

GET http://localhost:8000/en-US/module/system/Splunk.Module.[module_name]/render?sid=[job_id]&client_app... 500 (Internal Server Error)

I believe it's being caused by a line in the python script in generateResults():

job = splunk.search.getJob(sid, sessionKey=cherrypy.session['sessionKey'])

I'm running Splunk 4.2.2

Any help is appreciated

EDIT:
This is the entire error:

2011-07-25 09:50:21,400 DEBUG [4e2d749d611ec1530] cplogging:55 - [25/Jul/2011:09:50:21] HTTP Traceback (most recent call last):

File "/Applications/splunk/lib/python2.6/site-packages/cherrypy/_cprequest.py", line 606, in respond

cherrypy.response.body = self.handler()

File "/Applications/splunk/lib/python2.6/site-packages/cherrypy/_cpdispatch.py", line 25, in __call
_

return self.callable(*self.args, **self.kwargs)

File "/Applications/splunk/lib/python2.6/site-packages/splunk/appserver/mrsparkle/lib/routes.py", line 320, in default

return route.target(self, **kw)

File "", line 1, in

File "/Applications/splunk/lib/python2.6/site-packages/splunk/appserver/mrsparkle/lib/decorators.py", line 38, in rundecs

return fn(*a, **kw)

File "", line 1, in

File "/Applications/splunk/lib/python2.6/site-packages/splunk/appserver/mrsparkle/lib/decorators.py", line 106, in check

return fn(self, *a, **kw)

File "", line 1, in

File "/Applications/splunk/lib/python2.6/site-packages/splunk/appserver/mrsparkle/lib/decorators.py", line 155, in validate_ip

return fn(self, *a, **kw)

File "", line 1, in

File "/Applications/splunk/lib/python2.6/site-packages/splunk/appserver/mrsparkle/lib/decorators.py", line 290, in preform_sso_check

return fn(self, *a, **kw)

File "", line 1, in

File "/Applications/splunk/lib/python2.6/site-packages/splunk/appserver/mrsparkle/lib/decorators.py", line 327, in check_login

return fn(self, *a, **kw)

File "", line 1, in

File "/Applications/splunk/lib/python2.6/site-packages/splunk/appserver/mrsparkle/lib/decorators.py", line 348, in handle_exceptions

return fn(self, *a, **kw)

File "/Applications/splunk/lib/python2.6/site-packages/splunk/appserver/mrsparkle/controllers/module.py", line 62, in renderModule

return util.set_cache_level('etag', pageContent)

File "/Applications/splunk/lib/python2.6/site-packages/splunk/appserver/mrsparkle/lib/util.py", line 620, in set_cache_level

if apply_etag(response):

File "/Applications/splunk/lib/python2.6/site-packages/splunk/appserver/mrsparkle/lib/util.py", line 577, in apply_etag

hash.update(contentstring)

TypeError: update() argument 1 must be string or read-only buffer, not int

EDIT2: I've tried a few other things...

result = os.popen('curl -u admin:changeme -k https://localhost:8089/services/search/jobs/'+jobId+'/results/').read()

returns an empty string when used in the module; the equivalent works in a shell

return httplib2.Http().request('https://localhost:8089/services/search/jobs'+jobId+'/results/', 'POST', headers={'Authorization': 'Splunk %s' % sKey})

gives me the above error when used in the module; works in the python interpreter

key = splunk.auth.getSessionKey('admin', 'changeme')

my_job = splunk.search.dispatch('search [terms]', namespace='search')

also gives me the above error when used in the module; works in the python interpreter

1 Solution

achung12
Explorer

Figured it out.. dumb Python mistake. Needed to cast my return variable to a string first, as it expects a string. Didn't realize the error message was referring to that.

View solution in original post

0 Karma

achung12
Explorer

Figured it out.. dumb Python mistake. Needed to cast my return variable to a string first, as it expects a string. Didn't realize the error message was referring to that.

0 Karma

achung12
Explorer

I get the same error when I do this, after authorizing and given "sKey" and launching a search with the id "jobId":

httplib2.Http().request('https://localhost:8089/services/search/jobs'+jobId+'/results/', 'POST', headers={'Authorization': 'Splunk %s' % sKey})

0 Karma

achung12
Explorer

I'm also subclassing from the DispatchModule, if that helps

0 Karma

achung12
Explorer

The whole traceback is too big to fit here, but it starts with:
File "/Applications/splunk/lib/python2.6/site-packages/cherrypy/_cprequest.py", line 606, in respond
cherrypy.response.body = self.handler()

and ends with:
File "/Applications/splunk/lib/python2.6/site-packages/splunk/appserver/mrsparkle/lib/util.py", line 577, in apply_etag
hash.update(contentstring)
TypeError: update() argument 1 must be string or read-only buffer, not int

At the moment, I'm just trying to retrieve search results

I used this example: splunk-base.splunk.com/answers/6666/how-do-you-create-custom-modules

0 Karma

araitz
Splunk Employee
Splunk Employee

I need more information, such as the specific error in web_service.log and more information on what the module is trying to do.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...

Design, Compete, Win: Submit Your Best Splunk Dashboards for a .conf26 Pass

Hello Splunkers,  We’re excited to kick off a Splunk Dashboard contest! We know that dashboards are a primary ...

May 2026 Splunk Expert Sessions: Security & Observability

Level Up Your Operations: May 2026 Splunk Expert Sessions Whether you are refining your security posture or ...