Hello,
I encountered errors which made some of my flash charts in form shows:
Results Error:
400 - Encountered an error while reading file
'/opt/splunk/var/run/splunk/dispatch/1277454683.1/prereport_0.csv.gz'.
Above the broken flash charts it displays "No results found."
I clicked "More Info ..." link and the popup page (normally should be Job Inspector page) shows:
500 Internal Server Error
KeyError: 'performance'
This page was linked to from http://xxxxxxxx:8000/en-US/app/search/aaa_test.
And the top of the form page displays:
Encountered an error while reading file '/opt/splunk/var/run/splunk/dispatch/1277454683.1/prereport_0.csv.gz'.
The timestamp directory part in the file changes in each attemept.
I checked the log and found some related entries to error code 400 in web_service.log:
...
web_service.log:BadRequest: [HTTP 400] Bad Request; [{'text': "Encountered an error while reading file '/opt/splunk/var/run/splunk/dispatch/1277454683.1/prereport_0.csv.gz'.", 'code': None, 'type': 'FATAL'}]
web_service.log:2010-06-25 08:31:51,690 ERROR [4c246977afa96cdec] proxy:70 - [HTTP 400] Bad Request; [{'text': "Encountered an error while reading file '/opt/splunk/var/run/splunk/dispatch/1277454683.1/prereport_0.csv.gz'.", 'code': None, 'type': 'FATAL'}]
...
But I can't find any related log to error code 500.
Can anyone give me a hint or two? Thanks!
I've been told that this prereport_0 error is a known issue in 4.1.3 to be fixed in 4.1.4, but I've not been told what the problem is.
Updated, with better info:
It seems this is SPL-31791 "when 2 searches share a subsearch, error can result". Apparently this happens to do with two copies of a similar subsearch being launched at a close point in time, typically when a dashboard has the same subsearch used in two charts. A clumsy workaround might be to slightly modify one of the subsearches. It might be possible that two users hitting the same page might cause this though, for which I have no workaround
is there any chance to have any workaround before the fix is available?