Unable to export CSV file from the Splunk

Applicability

Splunk Enterprise

Description

When exporting data using CSV file from the Splunk search head, which shows XML error:
This XML file does not appear to have any style information associated with it. The document tree is shown below.

<response>
<messages>
<msg type="ERROR">Service Unavailable</msg>
</messages>
</response>

Investigation

Tried to export the search to the csv file format from the Splunk search head getting the xml error "Service Unavailable".

<response>
<messages>
<msg type="ERROR">Service Unavailable</msg>
</messages>
</response>

ERROR SearchOperator:inputcsv [1504834 TcpChannelThread] - Error in 'inputlookup' command: Lookup failed because collection 'acknotescoll' in app 'TA-FireEye_v3' does not exist, or user 'admin' does not have read access.

ERROR SearchOperator:inputcsv [1504837 TcpChannelThread] - SearchMessage orig_component=SearchOperator:inputcsv sid= message_key=INPUT_CSV:INVALID_LOOKUP_TABLE_TYPE__%s message=The lookup table 'previously_seen_users_console_logins_cloudtrail' requires a .csv or KV store lookup definition.

 

Resolution

This is a known issue which has been fixed in Splunk Enterprise 9.0.2208.  

The workaround in place for those who cannot upgrade yet is

• Update the PYTHONHTTPSVERIFY in $SPLUNK_HOME/etc/splunk-launch.conf, with the following setting 

PYTHONHTTPSVERIFY = 0

• Distribute the configuration files to the remainder of your Splunk platform instances.
• Restart the Splunk platform instances.

 

Related Links

Configure TLS host name validation for Splunk Python modules ​​​​​​​

 

Revision History

Revision	Publish Date	Comments
1.0	29-Sep-2026	Initial Release