event_message="Ignored some unknown output_modes." or event_message=Unknown output mode="html", skipping. 

Available Languages

Updated:September 29, 2026
Document ID:SPLK047513

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Applicability

Splunk Enterprise 9.1.5

Description

There are several errors in the search head cluster environment (SHC). These errors are :

event_message="Ignored some unknown output_modes." or event_message=Unknown output mode="html", skipping.

Investigation

Upon investigating Splunkd log, a search was made with "output" AND "HTML" and the following event was found.

/opt/splunkbot/splunkcoreengine/ce_diags/in_progress/tmp097i6467/extracted/diag-hq-spl-sh01-2024-10-01_08-41-52/etc/apps/canary/default/restmap.conf                       handler = view.CanaryViewHandler
/opt/splunkbot/splunkcoreengine/ce_diags/in_progress/tmp097i6467/extracted/diag-hq-spl-sh01-2024-10-01_08-41-52/etc/apps/canary/default/restmap.conf                       match = /sv_view
/opt/splunkbot/splunkcoreengine/ce_diags/in_progress/tmp097i6467/extracted/diag-hq-spl-sh01-2024-10-01_08-41-52/etc/apps/canary/default/restmap.conf                       output_modes = html
/opt/splunkbot/splunkcoreengine/ce_diags/in_progress/tmp097i6467/extracted/diag-hq-spl-sh01-2024-10-01_08-41-52/etc/apps/canary/default/restmap.conf                       passHttpCookies = false
/opt/splunkbot/splunkcoreengine/ce_diags/in_progress/tmp097i6467/extracted/diag-hq-spl-sh01-2024-10-01_08-41-52/etc/apps/canary/default/restmap.conf                       passHttpHeaders = true

The above log showed the Canarian app responsible of the errors, but any app which uses restmap.conf and the attribute output_mode. 

A test environment was created to test if the app generates these errors by default. After installing a search head instance and installing the app the errors started showing up immediately.


Resolution

Change the restmap.conf in the app's directory to stop the error.

Change the attribute:

output_mode = html
TO
output_mode = xml

The reason is that the `output_mode=` has only 2 values in Splunk documentation for restmap.conf. The error event_message=Unknown output mode="html", skipping proved this as Splunk couldn't recognize the value.


Restmap configuration

SplunkBase - Canary

Revision History

Revision Publish Date Comments
1.0
29-Sep-2026
Initial Release

Was this Document Helpful?

FeedbackFeedback

Contact Cisco

This Document Applies to These Products