Sorry for bringing this up again, but the other questions haven't been answered yet in a way that would help us.
I'm getting said error, but only when trying to upload the whole log file. I tried just uploading a single line, that works fine.
We're currently using Splunk 6.5.0 on Ubuntu (16, I think) and the log files are custom log files created by NGINX, but nothing special, here's an anonymized sample line:
2016-11-14T16:35:28+01:00 xxx.xxx.xxx.xxx - xxx.xxx.xxx.xxx 443 GET /xxx/xxx/xxx.xxx xxx=xxx&xxx=xxx&xxx=xxx&xxx=xxx&xxx=xxx 200 1267 0.419 "Apache-HttpClient/4.5.1 (Java/1.8.0_92)"
I already checked the file, if there's any lines with more or less entries, that might result in a null value, but they all had the 12 entries we are expecting.
Any more ideas on what the problem could be? Is there maybe a validation tool that we can run to check, if the log file is OK to import? The check I ran was just a simple CSV parser that checked line by line for the number of entries, so maybe that missed something.
Thanks a lot!
Seems to be a browser session issue. Opening the Splunk Web in 'incognito' mode in Chrome fixed for me.
@dwoehr
Can you accept the answer if it's helped you? Thanks.
it worked also for me, thanks for your solution
You can also try to open the file in an editor and save to a different type like UTF-8 instead of ASCII. That worked for me just now. (v7.2.1)
I get this error trying to do the friggin Splunk tutorial!
Using the provided access_30DAY.log file from Splunk Fundamentals 1, on a Mac with Chrome, against the Enterprise Splunk 30 day single instance in the DMG.
https://s3-us-west-2.amazonaws.com/splunk-fundamentals-data/Splunk_f1_Data.zip
https://download.splunk.com/products/splunk/releases/7.1.0/osx/splunk-7.1.0-2e75b3406c5b-macosx-10.1...
No clue how to work around a provided tutorial file executed against a caned Splunk instance..,
I've got the same error when uploading file from Firefox. Then I used Chrome and it works
This works!
Hi dwoehr!
A couple of followup questions...
If this happens just for one file
Are there any weird unicode characters in the file that might mess it up?
This would be likelier to happen in CSVs than in LOG files.
If this happens for all files
Try it out in a different browser.
For me, was getting consistent errors for different files, and different file types.
When I stopped using Safari and started using Firefox, it was fixed.
Safari has much stricter security than most other browsers, which can get in the way of some web-apps functionalities.
The error message you cite sounds like it comes from Python rather than Core Splunk. That would imply you are using a scripted or modular input. Is that the case? If so, which one?
This issues happens when using FF or IE. Chrome handles the upload just fine. Please submit this as feedback to Firefox to fix this issue.
No, I just used Splunk's Web-Interface (Settings -> Add Data -> Upload)
I have the exact same when uploading a .CSV file through the initial "Add Data" screen on the web interface.
There are probably weird characters in my CSV, but I've cleaned all quotes, magic quotes, and other characters that might be confusijng, but it opens fine (with correct number of columns) in Excel and Numbers.app.
Any thoughts?
Cheers,
Ralph
To me it happened with every file, and every file type.
Changing browser from Safari to Firefox fixed it.
I changed browser from Chome to Edge and it worked - could also try incognito instead