Splunk Search

Internal Server Error trying to retrieve search results from custom module

achung12
Explorer

When my module tries to retrieve results from a search launched by a user, it produces this error:

GET http://localhost:8000/en-US/module/system/Splunk.Module.[module_name]/render?sid=[job_id]&client_app... 500 (Internal Server Error)

I believe it's being caused by a line in the python script in generateResults():

job = splunk.search.getJob(sid, sessionKey=cherrypy.session['sessionKey'])

I'm running Splunk 4.2.2

Any help is appreciated

EDIT:
This is the entire error:

2011-07-25 09:50:21,400 DEBUG [4e2d749d611ec1530] cplogging:55 - [25/Jul/2011:09:50:21] HTTP Traceback (most recent call last):

File "/Applications/splunk/lib/python2.6/site-packages/cherrypy/_cprequest.py", line 606, in respond

cherrypy.response.body = self.handler()

File "/Applications/splunk/lib/python2.6/site-packages/cherrypy/_cpdispatch.py", line 25, in __call
_

return self.callable(*self.args, **self.kwargs)

File "/Applications/splunk/lib/python2.6/site-packages/splunk/appserver/mrsparkle/lib/routes.py", line 320, in default

return route.target(self, **kw)

File "", line 1, in

File "/Applications/splunk/lib/python2.6/site-packages/splunk/appserver/mrsparkle/lib/decorators.py", line 38, in rundecs

return fn(*a, **kw)

File "", line 1, in

File "/Applications/splunk/lib/python2.6/site-packages/splunk/appserver/mrsparkle/lib/decorators.py", line 106, in check

return fn(self, *a, **kw)

File "", line 1, in

File "/Applications/splunk/lib/python2.6/site-packages/splunk/appserver/mrsparkle/lib/decorators.py", line 155, in validate_ip

return fn(self, *a, **kw)

File "", line 1, in

File "/Applications/splunk/lib/python2.6/site-packages/splunk/appserver/mrsparkle/lib/decorators.py", line 290, in preform_sso_check

return fn(self, *a, **kw)

File "", line 1, in

File "/Applications/splunk/lib/python2.6/site-packages/splunk/appserver/mrsparkle/lib/decorators.py", line 327, in check_login

return fn(self, *a, **kw)

File "", line 1, in

File "/Applications/splunk/lib/python2.6/site-packages/splunk/appserver/mrsparkle/lib/decorators.py", line 348, in handle_exceptions

return fn(self, *a, **kw)

File "/Applications/splunk/lib/python2.6/site-packages/splunk/appserver/mrsparkle/controllers/module.py", line 62, in renderModule

return util.set_cache_level('etag', pageContent)

File "/Applications/splunk/lib/python2.6/site-packages/splunk/appserver/mrsparkle/lib/util.py", line 620, in set_cache_level

if apply_etag(response):

File "/Applications/splunk/lib/python2.6/site-packages/splunk/appserver/mrsparkle/lib/util.py", line 577, in apply_etag

hash.update(contentstring)

TypeError: update() argument 1 must be string or read-only buffer, not int

EDIT2: I've tried a few other things...

result = os.popen('curl -u admin:changeme -k https://localhost:8089/services/search/jobs/'+jobId+'/results/').read()

returns an empty string when used in the module; the equivalent works in a shell

return httplib2.Http().request('https://localhost:8089/services/search/jobs'+jobId+'/results/', 'POST', headers={'Authorization': 'Splunk %s' % sKey})

gives me the above error when used in the module; works in the python interpreter

key = splunk.auth.getSessionKey('admin', 'changeme')

my_job = splunk.search.dispatch('search [terms]', namespace='search')

also gives me the above error when used in the module; works in the python interpreter

1 Solution

achung12
Explorer

Figured it out.. dumb Python mistake. Needed to cast my return variable to a string first, as it expects a string. Didn't realize the error message was referring to that.

View solution in original post

0 Karma

achung12
Explorer

Figured it out.. dumb Python mistake. Needed to cast my return variable to a string first, as it expects a string. Didn't realize the error message was referring to that.

0 Karma

achung12
Explorer

I get the same error when I do this, after authorizing and given "sKey" and launching a search with the id "jobId":

httplib2.Http().request('https://localhost:8089/services/search/jobs'+jobId+'/results/', 'POST', headers={'Authorization': 'Splunk %s' % sKey})

0 Karma

achung12
Explorer

I'm also subclassing from the DispatchModule, if that helps

0 Karma

achung12
Explorer

The whole traceback is too big to fit here, but it starts with:
File "/Applications/splunk/lib/python2.6/site-packages/cherrypy/_cprequest.py", line 606, in respond
cherrypy.response.body = self.handler()

and ends with:
File "/Applications/splunk/lib/python2.6/site-packages/splunk/appserver/mrsparkle/lib/util.py", line 577, in apply_etag
hash.update(contentstring)
TypeError: update() argument 1 must be string or read-only buffer, not int

At the moment, I'm just trying to retrieve search results

I used this example: splunk-base.splunk.com/answers/6666/how-do-you-create-custom-modules

0 Karma

araitz
Splunk Employee
Splunk Employee

I need more information, such as the specific error in web_service.log and more information on what the module is trying to do.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...