Users running Advanced Features in TIBCO LogLogic Log Management Intelligence (LMI) can sometimes encounter issues with advanced search query returning an error instead of search results. When users encounter the error "Error processing query: parser with name xxxxxxxx has not been loaded" it typically means there is an issue with the corresponding data models being loaded into the Zookeeper configuration. For example, an error when running the query "use Microsoft_Windows | sys_eventTime IN -1h"  looks as follows:
 

1. Ensure that the Zookeeper configuration lists the sources that are part of the configuration correctly. To do this, users can navigate to the following URL: https://1.1.1.1/logapp20/logu/monitoring (replacing the 1.1.1.1 with the appliance IP or DNS).  Users will be required to login to the webUI first if they haven't already done so to access that URL. Under the list of items available, navigate to Sources and look for the source that has caused the error. In the above example, users should look for Microsoft_Windows source in the list to ensure Zookeeper has the source in the configuration.
2. If the source does exist in the above URL, then users need to check the database to see if the actual entry is missing. The Zookeeper configuration is only a pointer to the configuration stored in the database. If Zookeeper has listed the source, but the error persists, then it is evident that the configuration pointer in Zookeeper is present but the actual configuration in the database might be missing or invalid. To check the actual configuration, follow the steps below:
   1. Login to CLI as toor
   2. Issue the command $ mysql logapplogu
   3. After getting dropped into MySQL, execute the command: mysql> select name from eventsourceconfiguration;

That above command should list the same number of sources that are listed in the Zookeeper configuration. As of LMI 6.2.1 the count should be 113. If the  eventsourceconfiguration table has a data model missing, then follow the steps in the resolution section under "Database Issue Resolution". If the issue is with Zookeeper refer to "Zookeeper configuration issue resolutions" section.

This article describes the error message "Parser with name xxxxxx has not been loaded" that users may encounter when running advanced search queries.

Users must have Advanced features enabled and should have access to both CLI and UI as administrator.

Zookeeper Configuration Issue Resolution:

If users encounter the issue with zookeeper configuration missing data models, then this will likely have to be recreated in the Zookeeper configuration. To do that follow the steps below:

1. Users will need to get access to Zookeeper CLI (not provided with LMI up to version 6.2.1). Contact TIBCO Support for these files if you are using an LMI version between 6.1.0 and 6.2.1, inclusive.
2. Execute the command $ ./zkCli.sh -server 127.0.0.1:9600
3. After getting connected, execute the command delete /unity/system/config/machine/machine-0000000000
4. Stop engine_lldaemon by executing the command $ mtask -s engine_lldaemon stop
5. Start engine_lldaemon by executing the command $ mtask -s engine_lldaemon start

This should recreate the Zookeeper configuration and replace the damaged/invalid configuration with a new configuration that correctly contains all sources.

Database Issue Resolution:

If users encounter the issue with database table missing entries, the only way to recover from that is to reinstall Log Source Package (LSP) on the system. This table is populated by LSP and is not backed up by LMI. So to recover from this issue, users will have to perform an LSP reinstall. Follow the steps below to reinstall LSP:

1. Download the appropriate version of LSP from suppport.tibco.com website.
2. SCP the .bin executable file anywhere onto the system.
3. Execute the .bin file.
4. Follow the onscreen instructions to install the LSP. 

Note: This will restart the application which can cause data loss for the amount of time the application is down.

An LSP reinstall should replace the existing table with a new copy of the source table. This should populate the entries that are missing or are invalid.