Splunk® Enterprise

Search Manual

Download manual as PDF

Splunk Enterprise version 6.x is no longer supported as of October 23, 2019. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see How to upgrade Splunk Enterprise.
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Download topic as PDF

Externalized Search Error Strings

Externalized search errors

All externalized strings in Splunk Enterprise, including error strings for search commands, are defined in the literals.conf configuration file. A Splunk user and administrator should not need to edit this file. However a Splunk developer might want to overwrite existing strings or define custom configurations.

The configuration file is located in $SPLUNK_HOME/etc/system/default/literals.conf. DO NOT edit this file. Read the rest of this topic before proceeding.

Search error strings

The part of the file dedicated to search error strings is indicated with:

# String externalization starts here

This is followed with a stanza for each search command that has error strings associated with it. For example, the eval command's stanza reads:

MISSING_ARGS		= Missing arguments. usage: eval dest_key = expression
FAILED_PARSE		= Failed to parse arguments. eval usage: eval dest_key = expression
INVALID_DEST		= Invalid destination key
BOOLEAN_RESULT		= The result of an expression cannot be boolean. Try if([bool expr], [expr], [expr])
BAD_DEST_BRACKETS	= Invalid destination field. {} brackets must be closed
INVALID_OP__S		= Invalid operator at '%s'
TYPE_FAIL_CONCAT	= Typechecking failed. '.' operator only takes strings and numbers
TYPE_FAIL_DIFF__S	= Typechecking failed. '%s' operator received different types
TYPE_FAIL_PLUS		= Typechecking failed. '+' only takes two strings or two numbers
TYPE_FAIL_NUM__S	= Typechecking failed. '%s' only takes numbers
TYPE_FAIL_BOOL__S	= Typechecking failed. '%s' only takes boolean arguments
MATCH_FAIL__C		= Malformed expression - %c expected
CONSUME_FAIL__S		= Malformed expression - %s expected
INVALID_NUMBER__S	= Invalid number: %s
INVALID_UNARY_OP	= Malformed expression - Invalid unary op
UNEXPECTED_CHAR__C	= Malformed expression - Unexpected character hit in factor: %c
MISSING_FACTOR		= Malformed expression - Missing factor
MISSING_TERM		= Malformed expression - Missing term
MISSING_COMP_TERM	= Malformed expression - Missing comparison term
MISSING_AND		= Malformed expression - Missing AND term
MISSING_OR		= Malformed expression - Missing OR term
INVALID_FUNC_ARGS__S	= Invalid arguments to '%s' function
BAD_FUNC__S		= Unsupported Function: %s

Overwrite or define error strings

Before you edit literals.conf, refer to the configuration specification and example files:

  • $SPLUNK_HOME/etc/system/README/literals.conf.spec
  • $SPLUNK_HOME/etc/system/README/literals.conf.example

To overwrite existing error strings or define custom error strings, create a literals.conf file in:


Overwrite an existing string by copying the stanza name, the attribute, and value pair from the default literals.conf file into the local literals.conf file. Then edit the value in the local copy literals.conf file.

Define all new custom configurations in the local copy of the literals.conf file.

Important: Editing the literals.conf file incorrectly can seriously impact the performance of Splunk Enterprise. Use the following guidelines for any changes that you make to configurations in literals.conf file.

  • Externalized strings are defined with attribute name and value pairs. You should need to edit only the attribute values. DO NOT edit the attribute names.
  • When strings contain "%s", DO NOT add or remove instances of %s or reorder their positions.
  • When strings contain HTML tags and entities, make sure that all of the strings are properly escaped.
Last modified on 12 August, 2015
Custom search command example
What's in this section?

This documentation applies to the following versions of Splunk® Enterprise: 6.2.0, 6.2.1, 6.2.2, 6.2.3, 6.2.4, 6.2.5, 6.2.6, 6.2.7, 6.2.8, 6.2.9, 6.2.10, 6.2.11, 6.2.12, 6.2.13, 6.2.14, 6.2.15

Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters