Externalized search errors

Externalized search errors

All externalized strings in Splunk, including error strings for search commands, are defined in the literals.conf configuration file. A Splunk user and administrator should not need to edit this file; however, a Splunk developer may wish to overwrite existing strings or define custom configurations.

The configuration file is located in $SPLUNK_HOME/etc/system/default/literals.conf. DO NOT edit this file. Read the rest of this topic before proceeding.

Search error strings

The part of the file dedicated to search error strings is indicated with:

# String externalization starts here

This is followed with a stanza for each search command that has error strings associated with it. For example, the eval command's stanza reads:

[EVAL]
MISSING_ARGS		= Missing arguments. usage: eval dest_key = expression
FAILED_PARSE		= Failed to parse arguments. eval usage: eval dest_key = expression
INVALID_DEST		= Invalid destination key
BOOLEAN_RESULT		= The result of an expression cannot be boolean. Try if([bool expr], [expr], [expr])
BAD_DEST_BRACKETS	= Invalid destination field. {} brackets must be closed
INVALID_OP__S		= Invalid operator at '%s'
TYPE_FAIL_CONCAT	= Typechecking failed. '.' operator only takes strings and numbers
TYPE_FAIL_DIFF__S	= Typechecking failed. '%s' operator received different types
TYPE_FAIL_PLUS		= Typechecking failed. '+' only takes two strings or two numbers
TYPE_FAIL_NUM__S	= Typechecking failed. '%s' only takes numbers
TYPE_FAIL_BOOL__S	= Typechecking failed. '%s' only takes boolean arguments
MATCH_FAIL__C		= Malformed expression - %c expected
CONSUME_FAIL__S		= Malformed expression - %s expected
INVALID_NUMBER__S	= Invalid number: %s
INVALID_UNARY_OP	= Malformed expression - Invalid unary op
UNEXPECTED_CHAR__C	= Malformed expression - Unexpected character hit in factor: %c
MISSING_FACTOR		= Malformed expression - Missing factor
MISSING_TERM		= Malformed expression - Missing term
MISSING_COMP_TERM	= Malformed expression - Missing comparison term
MISSING_AND		= Malformed expression - Missing AND term
MISSING_OR		= Malformed expression - Missing OR term
INVALID_FUNC_ARGS__S	= Invalid arguments to '%s' function
BAD_FUNC__S		= Unsupported Function: %s

Overwrite or define error strings

Before you edit literals.conf, refer to the configuration specification and example files:

• $SPLUNK_HOME/etc/system/README/literals.conf.spec
• $SPLUNK_HOME/etc/system/README/literals.conf.example

To overwrite existing error strings or define custom error strings, create a literals.conf in:

$SPLUNK_HOME/etc/system/local/

Overwrite an existing string by copying the stanza name and the attribute and value pair from the default literals.conf into the local literals.conf. Then, edit the value in the local copy literals.conf.

Define all new custom configurations in the local copy of literals.conf.

Important: Editing literals.conf incorrectly can seriously impact Splunk's performance. The following are guidelines for any changes you make to configurations in literals.conf:

• Externalized strings are defined with attribute name and value pairs. You should only need to edit the attribute values. DO NOT edit the attribute names.
• When strings contain "%s", DO NOT add or remove instances of %s or reorder their positions.
• When strings contain HTML tags and entities, make sure all are properly escaped.

• Was this topic useful?
• Post a comment