All Apps and Add-ons

Pulldown works great for admin, not for other users

kjcorbin
Explorer

I have a form that uses Sideview utils to populate 2 pulldowns. When I run this as admin it works perfectly. My initial thought was it must be permissions related. However, when I gave this other user admin permissions they still saw the same error.

The error message is [SimpleResultsTable module] Server reported HTTP status=400 while getting mode=results <?xml version='1.0' encoding='UTF-8'?> Error in 'stats' command: The rename value is invalid..

When the pulldown finishes loading there are no results. I assume that is what is causing this error to appear. WIth out results in the pulldown the substitution should fail. What has me perplexed is why no results are being returned when the same query run by hand works. I have a similar set up on another page and it works correctly. The only difference between the two is this one returns 2 values with the initial search and then does post-processing in the pulldown.

Here is the XML snippet:

 <view autoCancelInterval="90" isVisible="true" onunloadCancelJobs="true" template="dashboard.html" isSticky="False">
  <label>Statistic Detail Search Form</label>
  <module name="AccountBar" layoutPanel="appHeader" />
  <module name="AppBar" layoutPanel="appHeader" />
  <module name="SideviewUtils" layoutPanel="appHeader" />
  <module name="Message" layoutPanel="messaging">
     <param name="filter">*</param>
     <param name="maxSize">2</param>
     <param name="clearOnJobDispatch">False</param>
   </module>
   <module name="HTML" layoutPanel="viewHeader">
      <param name="html"><![CDATA[
         <h1>Statistic Detail Search Form</h1>
         ]]></param>
   </module>  
   <module name="Search" layoutPanel="panel_row2_col1" autoRun="True">
      <param name="search">index="main" | stats count by ServiceName FullCounterName</param>
      <param name="earliest">-4h</param>
      <param name="latest">-5m</param>
      <module name="Pulldown" autoRun="False">
         <param name="name">ServiceName</param>
         <param name="size">4</param>
         <param name="label">Service Name:</param>
         <param name="template">ServiceName="$value$"</param>
         <param name="separator">+OR+</param>
         <param name="postProcess">dedup $name$ | sort $name$</param>
         <param name="outerTemplate">( $value$ )</param>
         <param name="searchFieldsToDisplay">
         <list>
             <param name="label">ServiceName</param>
             <param name="value">ServiceName</param>
          </list>
         </param>
         <module name="Pulldown" layoutPanel="panel_row2_col1">
               <param name="name">FullCounterName</param>
               <param name="staticFieldsToDisplay"></param>
               <param name="size">1</param>
               <param name="label">Counter Name:</param>
               <param name="template">$value$</param>
               <param name="postProcess"> dedup $name$ | sort $name$</param>
               <param name="searchFieldsToDisplay">
                <list>
                   <param name="label">FullCounterName</param>
                  <param name="value">FullCounterName</param>
                </list>
              </param>
<module name="Pulldown" layoutPanel="panel_row2_col1" >
<param name="name">time_bucket</param>
<param name="label">Time Bucket Size </param>
<param name="staticFieldsToDisplay">
  <list>
    <param name="label">30 Minutes</param>
    <param name="value">30m</param>
  </list>
  <list>
    <param name="label">60 Minutes</param>
    <param name="value">60m</param>
  </list>
  <list>
    <param name="label">90 Minutes</param>
    <param name="value">90m</param>
  </list>
  <list>
    <param name="label">3 hours</param>
    <param name="value">3h</param>
  </list>
  <list>
    <param name="label">6 Hours</param>
    <param name="value">6h</param>
  </list>
  <list>
    <param name="label">12 Hours</param>
    <param name="value">12h</param>
  </list>
  <list>
    <param name="label">24 Hours</param>
    <param name="value">24h</param>
  </list>
  </param>
  <module name="TimeRangePicker" layoutPanel="panel_row2_col1">
  <param name="searchWhenChanged">True</param>
  <param name="selected">Last 4 hours</param>
  <param name="label">Time Frame:</param> 
  <module name="Search" autoRun="False">
    <param name="search">source="msmetrics socket" $ServiceName$     FullCounterName="$FullCounterName$"|bin _time span=$time_bucket$ | stats sum(CounterValue) as "$FullCounterName$" by _time ServiceName
     </param>
    <module name="JobProgressIndicator"></module>
    <module name="PostProcess">
    <param name="search">timechart sum($FullCounterName$) as "$FullCounterName$"  by ServiceName</param>
    <module name="HiddenChartFormatter">
     <param name="chart">line</param>
      <param name="charting.chart.nullValueMode">connect</param>
       <param name="primaryAxisTitle.text">time</param>
       <param name="secondaryAxisTitle.text">Value</param>
       <param name="legend.placement">top</param>
     <module name="FlashChart">
      <param name="width">100%</param>
      <param name="height">400px</param>
     </module>
     </module>
     </module>
    <module name="Pager">
      <param name="entityName">results</param>
      <module name="SimpleResultsTable">
        <param name="displayRowNumbers">True</param>
        <param name="entityName">results</param>
        <param name="count">30</param>
      </module>
     </module>
     </module>
     </module>
 </module>
 </module>
 </module>
 </module>
 </view>
Tags (1)
1 Solution

sideview
SplunkTrust
SplunkTrust

Well we can certainly figure this out. First though that error is talking about a stats command that isn't included. Can you include the lower search so we can see how the args are put together? Also based on the error splunk doesn't seem to like something your search is doing in an inline rename, within the stats command, and im not sure how the Pulldown could be the root cause. At any rate I suspect I'll be able to find the problem if you include that lower search module.

Another idea is that when you run it by hand are you using those same time arguments in the timeRangePicker (via its "custom" mode). Its possible that in some timeres it is simply matching no results.

One side note in the meantime is that you should never have two modules in a given chain with autorun=True. That will cause dispatch, cancel, dispatch and thrash the browser a bit.


UPDATE: Well I don't see anything wrong with your XML now, and I see you removed the extra autoRun="True". I tried using your XML, substituting your search for a local base search that works on my instance, and substituting your ServiceName and FullCounterName fields and tokens for fields I have in my instance, and the view works fine with no problems, which is what I'd expect reading it.

Thinking about this more I actually think the placement of autoRun might have been causing this issue. When there are two autoRun="True" attributes, they both fire and both start cascading pushes downstream. The lower one, since it started below that first Pulldown, it will be pushing an empty value for that first Pulldown key. Also the lower one will have a slight headstart. From here the race gets a little dependent on system characteristics. However on a faster system the later push which has the correct value for the first Pulldown, can actually lose in favor of the earlier push with the incorrect value (a known problem that I think is being worked on). So it's quite feasible that it was that second autoRun="True" that was actually the issue. I know it sounds like I'm out on a limb here, and maybe I am, but have you already tried to reproduce the problem with only that one autoRun="True"?

For what it's worth I just tried several configurations of the adopted view with various misplaced autoRun's and multiple autoRuns and although I cannot hit the specific error you hit, I certainly hit a lot of configurations that fail to load the Pulldown correctly.

In short,

--- it's autoRun that starts the 'push' and it's the 'push' that ends up dispatching all searches, so autoRun is pretty instrumental in populating all Pulldown modules.

--- This 'push' business is pretty unintuitive so it's quite likely that after reading all this your eyebrows are somewhat elevated and/or askew. Looking at your XML, you clearly know what you're doing and you've invested time in understanding this stuff. I think it's worth the slight extra time to cement your understanding of autoRun and the modules in general by reading the following post. (You can however completely ignore the specifics of the question and just skip down to the paragraph that begins "The trickiest thing to understand is...")

http://splunk-base.splunk.com/answers/28176/multiple-searches-with-single-parameter-in-advanced-view...

View solution in original post

0 Karma

sideview
SplunkTrust
SplunkTrust

Well we can certainly figure this out. First though that error is talking about a stats command that isn't included. Can you include the lower search so we can see how the args are put together? Also based on the error splunk doesn't seem to like something your search is doing in an inline rename, within the stats command, and im not sure how the Pulldown could be the root cause. At any rate I suspect I'll be able to find the problem if you include that lower search module.

Another idea is that when you run it by hand are you using those same time arguments in the timeRangePicker (via its "custom" mode). Its possible that in some timeres it is simply matching no results.

One side note in the meantime is that you should never have two modules in a given chain with autorun=True. That will cause dispatch, cancel, dispatch and thrash the browser a bit.


UPDATE: Well I don't see anything wrong with your XML now, and I see you removed the extra autoRun="True". I tried using your XML, substituting your search for a local base search that works on my instance, and substituting your ServiceName and FullCounterName fields and tokens for fields I have in my instance, and the view works fine with no problems, which is what I'd expect reading it.

Thinking about this more I actually think the placement of autoRun might have been causing this issue. When there are two autoRun="True" attributes, they both fire and both start cascading pushes downstream. The lower one, since it started below that first Pulldown, it will be pushing an empty value for that first Pulldown key. Also the lower one will have a slight headstart. From here the race gets a little dependent on system characteristics. However on a faster system the later push which has the correct value for the first Pulldown, can actually lose in favor of the earlier push with the incorrect value (a known problem that I think is being worked on). So it's quite feasible that it was that second autoRun="True" that was actually the issue. I know it sounds like I'm out on a limb here, and maybe I am, but have you already tried to reproduce the problem with only that one autoRun="True"?

For what it's worth I just tried several configurations of the adopted view with various misplaced autoRun's and multiple autoRuns and although I cannot hit the specific error you hit, I certainly hit a lot of configurations that fail to load the Pulldown correctly.

In short,

--- it's autoRun that starts the 'push' and it's the 'push' that ends up dispatching all searches, so autoRun is pretty instrumental in populating all Pulldown modules.

--- This 'push' business is pretty unintuitive so it's quite likely that after reading all this your eyebrows are somewhat elevated and/or askew. Looking at your XML, you clearly know what you're doing and you've invested time in understanding this stuff. I think it's worth the slight extra time to cement your understanding of autoRun and the modules in general by reading the following post. (You can however completely ignore the specifics of the question and just skip down to the paragraph that begins "The trickiest thing to understand is...")

http://splunk-base.splunk.com/answers/28176/multiple-searches-with-single-parameter-in-advanced-view...

0 Karma

sideview
SplunkTrust
SplunkTrust

Ah excellent. Well all's well that ends well. No worries; it's always fun to help even (especially) when I get to go out on a limb.

0 Karma

kjcorbin
Explorer

After digging deeper the problem was actually with an automatic lookup that had the incorrect permissions. Sorry to have troubled you, but thanks for all the detailed info.

0 Karma

kjcorbin
Explorer

I performed another test where I removed the post-process from the pulldown and it works. however, the inability to use the prost process in the pulldown means I would need to searches to generate 2 pulldowns.

0 Karma

kjcorbin
Explorer

Unfortunately, even with only one autoRun="True" I am still seeing the error.

It FEELS like it is permission related since it only happens to the non-admin user. admin can run it fine. But the permissions look right. And if I ad admin permissions to the other user they still see the error.

Is there anything permission related that would affect how the pulldown is populated?

I will read up on the link you sent to see if I can get a better understanding of the autoRun feature.

0 Karma

kjcorbin
Explorer

I have updated the original post to include the entire XML. The reason I was thinking it may be drop down related is that when I get the error the pulldown is not populated. This is odd, because if I run the search that I use to populate the pulldown by hand it returns results.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...