ERROR: Streamed search execute failed because: invalid name: '_'. name parameter must be non-empty and cannot start with '_' or '-'.

Applicability

Description

After upgrade from v9.2.1 to v9.3.1 searching custom indexes with index names starting with underscore fails, causing empty dashboards and reports.

Investigation

This error message is displayed error message when searching with a custom index with a name starting with underscore.

Resolution

In Splunk, you cannot create custom index names that begin with an underscore.

 This is because Splunk reserves underscores at the beginning of index names for internal indexes, such as _audit and _internal

If you need to create a custom index, you should start the name with a letter or number. It can include the underscore elsewhere in the name. For example: my_custom_index is a valid name, but _my_custom_index is not.

In versions prior to 9.3.1, this was not enforced, but this version onwards, this is enforced and causing searching issues.

The solution is to rename all the indexes that don't comply by following the name requirements: index names cannot begin with an underscore or hyphen, or contain the word "kvstore"

Related Links

Splunk reserves underscores at the beginning of index names

Create custom indexes