Splunk upgrade causes error in Zoom out option in sideview utils based chart

[keerthana_k]

Hi,
We use sideview utils in our application for visualization. We have customized an inbuilt visualization of sideview utils to use in our application. Recently, we upgraded our Splunk to 6.5.2. After that we observe that the Zoom out option in the chart is not functioning as expected. Upon debugging, we find the following error in the browser console.

Uncaught TypeError: Cannot read property 'DateTime' of undefined
    at klass.zoomOut (common.min.js:26987)
    at klass.zoomOut (modules-49ee4f4….min.js:3419)
    at HTMLAnchorElement.dispatch (common.min.js:1468)
    at HTMLAnchorElement.eventHandle (common.min.js:1280)

Has anyone faced this issue? Any inputs to fix this is highly appreciated.

Thanks,
Keerthana

[sideview · Accepted solution]

I have found the root cause of the issue, and it is a mistake in Splunk's code. A file that Splunk's JSChart imports after module initialization accidentally clobbers a bunch of other libraries that other Splunk code had imported earlier.

There are three options to fix this. 1) Hotfix Splunk's code directly, 2) If you're already using Sideview Utils, download the latest release which went up yesterday (mostly for this fix), or 3) wait for Splunk to hopefully fix it in a 6.5.X maintenance release.

1) If you need to hotfix a particular build, the following will fix the root cause directly.
Open $SPLUNK_HOME/share/splunk/search_mrsparkle/exposed/build/jscharting/index.js

the file is minified (even if you have minify_js=False in web.conf)
but fortunately the code in question is quite near the beginning .

Find the lines with these chars:

__WEBPACK_AMD_DEFINE_RESULT__=function(require){return splunk=__webpack_require__("shim/splunk")

the "splunk" reference there, is the mistake. As an undeclared variable the JS interpreter will look up the chain and assume the developer is referring to "window.splunk". End result is that window.splunk gets overwritten, including various libraries that had been imported into namespaces therein. (here the particular one was of course splunk.time.DateTime)

you can hotfix this by changing

return splunk=
to something as simple as

return splunk2=

that is still not great code, but it's a sufficient change to fix the bug.
NOTE that you have to explicitly clear the entire browser cache or hit the "bump" endpoint. (hitting reload and even shift-reload will not suffice here. Likewise restarting splunk has no effect whatsoever on clearing browser cache)

2) Dowload Sideview Utils 3.3.16
I was able to ship a patch for this problem. This was actually root cause for two other paying customers with similar cases in the field. I may refine the patch a bit more as time goes on -- I suspect there are quite a few edge case bugs that have as their root cause this same mistake in jscharting/index.js, and if there are others with different manifestations, the particular patch I've done may not suffice to fix them all.

3) Last but not least, Splunk will hopefully fix it themselves now that it has been reported, if you can wait that long.

[sideview]

Interesting. Sorry for the inconvenience and I'll get to the bottom of it asap. Can you please let me know the following?

-- Browser used ?
-- Splunk Version ?
-- Sideview Utils version ?
-- can you send a copy of the full XML for the view? I think seeing the whole view in context is important for me to fix. It sounds like there is not only a ZoomLinks module but also one or more DateTime modules in the view. Also I am curious if it's using a Timeline module.

Other questions that might take a bit longer
-- Can you send common.min.js ? and the modules-*.min.js file? (With js minification turned on, the line numbers in the error are only definitive if one has the compiled files to compare them with )
I believe you can find both files in
$SPLUNK_HOME/share/splunk/search_mrsparkle/exposed/js/build/bundles/

-- If the Sideview utils version is prior to the current release (3.3.15), I am curious as to whether upgrading to the latest fixes it.

-- Sideview Utils ships a hidden testcase view for both the ZoomLinks and the DateTime modules. If you have time can you visit these pages and interact with them a bit and see if you get any other exceptions?
/en-US/app/sideview_utils/testcases_for_datetime
/en-US/app/sideview_utils/testcases_for_zoomlinks

[sideview]

Posting Keerthana's answers here.
-- Browser used - Google Chrome Version 56.0.2924.87 (64-bit)
-- Splunk Version – Upgraded from 6.4.0 to 6.5.2
-- Sideview Utils version. – Tried in both 2.4.5 and 3.3.14 versions

and thanks for emailing the xml and the compiled js files.