All Apps and Add-ons

Search dispatch event error

guilhem
Contributor

Hello there!

With the help I've found here I have now a really good looking dashboard! I still have a little display problem.

On nearly all the computers of my company (mac, apple, with different browser/ versions), the dashboard fail consistently to finish searches (it sometimes work however). The JS console gives these errors:

line 1963 of modules-a74f21d3825a9abcd276b144e5f55c7f.min.js:

TypeError: response is undefined
for(var i=0;i<response.columns.length;i++){
sliced.columns[i]=response.columns[i].slice(0,howMany);}
return sliced;},

Splunk.Module.SavedSearch Context failed to dispatch job for search= XXXXXXX
modules-a74f21d3825a9abcd276b144e5f55c7f.min.js:89
Splunk.Module.$.klass._fireDispatchFailHandler modules-a74f21d3825a9abcd276b144e5f55c7f.min.js:89
(anonymous function) common.min.js:5625
(anonymous function) common.min.js:9947
(anonymous function) common.min.js:5625
deferred.resolveWith common.min.js:452
done common.min.js:3502
callback common.min.js:3842
Uncaught TypeError: Cannot read property 'columns' of undefined modules-a74f21d3825a9abcd276b144e5f55c7f.min.js:1963
Splunk.Module.JSChart.$.klass.sliceResultsBySeriesLength modules-a74f21d3825a9abcd276b144e5f55c7f.min.js:1963
Splunk.Module.JSChart.$.klass.getChartReadyData modules-a74f21d3825a9abcd276b144e5f55c7f.min.js:2271
Splunk.Module.JSChart.$.klass.draw modules-a74f21d3825a9abcd276b144e5f55c7f.min.js:2225
Splunk.Module.JSChart.$.klass.renderResults modules-a74f21d3825a9abcd276b144e5f55c7f.min.js:1953
getResultsXHRObject.$.ajax.success modules-a74f21d3825a9abcd276b144e5f55c7f.min.js:446
(anonymous function) common.min.js:5625
deferred.resolveWith common.min.js:452
done common.min.js:3502
callback

I really don't know what's going on, as it works perfectly on my computer (Apple Snow leopard with firefox 16), along with sideview utils 2.1 (didn't installed the 2.2 yet as I don't know how to update an app ... Will look into this later .)

Any help would be appreciated!

PS: I can post the full view if needed, but it is a lot of work to remove all private data, so I will do it only if nothing can be done with the error only

EDIT: I'm currently using splunk v4.3 and not the latest release, this may have been fixed since?

1 Solution

guilhem
Contributor

I didn't get response from splunk support as of today, so I'm trying to investigate whatever is happening here. Here is the JS execution pile when the bug occurs. We can see that the problem comes from the fact that a success callback is called, and the response given is "", so that's causing trouble when testing is the response is not null in the renderResult method.

The question is: why is the callback successfull when the response isn't ? I'm trying to do a little bit more JS digging right now and see if I can quick fix this error.

getChartReadyData(response=undefined, fieldInfo=Object { fieldNames=[0]}, properties=Object { enableChartClick=false, enableLegendClick=true, backgroundColor="rgb(255, 255, 255)", more...})

draw(updateCount=0)

renderResults(response="")

success(htmlFragment="", textStatus="success", xhr=Object { readyState=4, status=200,statusText="success"})

bind()

resolveWith(context=Object { url="/en-US/splunkd/search/j...w&output_mode=json_cols", isLocal=false, global=true, more...}, args=["", "success", Object { readyState=4, status=200
, statusText="success"}])

done(status=200, statusText="success", responses=Object { text=""}, headers="Status: 204\r\nContent-Le...t/plain;charset=utf-8\r\n")

callback(_=readystatechange , isAbort=undefined)

View solution in original post

0 Karma

guilhem
Contributor

I didn't get response from splunk support as of today, so I'm trying to investigate whatever is happening here. Here is the JS execution pile when the bug occurs. We can see that the problem comes from the fact that a success callback is called, and the response given is "", so that's causing trouble when testing is the response is not null in the renderResult method.

The question is: why is the callback successfull when the response isn't ? I'm trying to do a little bit more JS digging right now and see if I can quick fix this error.

getChartReadyData(response=undefined, fieldInfo=Object { fieldNames=[0]}, properties=Object { enableChartClick=false, enableLegendClick=true, backgroundColor="rgb(255, 255, 255)", more...})

draw(updateCount=0)

renderResults(response="")

success(htmlFragment="", textStatus="success", xhr=Object { readyState=4, status=200,statusText="success"})

bind()

resolveWith(context=Object { url="/en-US/splunkd/search/j...w&output_mode=json_cols", isLocal=false, global=true, more...}, args=["", "success", Object { readyState=4, status=200
, statusText="success"}])

done(status=200, statusText="success", responses=Object { text=""}, headers="Status: 204\r\nContent-Le...t/plain;charset=utf-8\r\n")

callback(_=readystatechange , isAbort=undefined)

0 Karma

guilhem
Contributor

Alleluiah! I have downloaded the 2.2.8 version of sideview utils, and the error seems to have disapeared! Thanks very much for the effort and all the support. Just for curiosity, how did you fixed it?

0 Karma

sideview
SplunkTrust
SplunkTrust

Could you give it a shot with the most recent version of Sideview Utils? Although I was unable to reproduce the bug, just from the stack and some educated guesses I was able to put in a patch to JSChart that will either make the error go away or will let the module get a little further and hit a second exception. If you can keep sending me stacks I can eventually triangulate. Very interesting that the response is empty - I've heard of this from other developers. With that in nmind I'll try and go back and reproduce again soon.

sideview
SplunkTrust
SplunkTrust

Oh sorry - since you were commenting on your own alternate answer, I didn't get a notification about that comment so I didn't notice it until just now. I'll check out your testcase today and the timing is good because there's a new Utils going up today or tomorrow.

0 Karma

guilhem
Contributor

The full test case is just in the comment of my response below, but I will send it to you if it could helps. Thanks for taking the time to answer.

0 Karma

sideview
SplunkTrust
SplunkTrust

I'm afraid I haven't tried to fix it yet, because I'm still waiting for you to send the view XML ( nick [at] sideviewapps.com ) or better yet, to create a reproducible case that just uses index=_internal data. If you can't do that though, just let me know and I'll give it a shot trying to patch it blind.

0 Karma

guilhem
Contributor

I have asked the splunk support team for any inputs on this problem (splunk version 4.3, build 115073, sideview utils 2.2)

I will post any answer I have from them, as I still have the error and don't want to hack the JS code.

0 Karma

guilhem
Contributor

The failure still happen consistently with sideview utils 2.2 that I have just installed.

0 Karma

guilhem
Contributor

Hello and thanks again for the fast answer. Here are some few points about this:

When I launch the view, I always have this error:

Response is undefined.

sliceResultsBySeriesLength:function(response,howMany){
var sliced=$.extend(true,{},response);
for(var i=0;i<response.columns.length;i++){
sliced.columns[i]=response.columns[i].slice(0,howMany);}
return sliced;},

It looks like above there is this test:

if(response){ ..

I think that the "if" fails to return false on an undefined value, instead it returns true and continue, thus leading to error later in the code (I'm by no way a JS dev so it may not be that at all).

-Also I couldn't manage to create a search running on _internal that reproduce the problem, I have tried but everything works when I create a search with the same tree structure of modules.

-It is really complicated for me to give you the full view + datas, as I need to obfuscate everything by hand, and the view is now pretty huge. Also I'm not event sure if it has anything to do with the big view (perhaps it does).

-A strange behavior is that when I reload the page (on computers of my company), the crash always happen (in fact it happen also for me), BUT the chart is displayed after several reloading of the page, and after that everything is always displayed (even after a reboot). The JS still crash but the charts are displayed.

-As a side note I am running with splunk 4.3 & sideview utils 2.1, but I diddn't see in any of the release note of splunk something related to this problem, so it may still be there (and I cannot upgrade splunk now).

I am very sorry I can't help you more on this bug by now. But I will tackle it and begin to make and obfuscated view + datas if I manage to reproduce the problem this way (which is not sure)

0 Karma

guilhem
Contributor

In fact I just made a view that runs on the _internal index that cause the error: here it is:

http://pastebin.com/FPheJhTc

And the savedSearch (TEST_saved Search_allTime):

index=_internal action=touch earliest=-30d@d
| stats dc(punct) as p max(linecount) as lc by date_month, date_wday, date_year, date_mday
| eventstats max(date_year) as d by date_mday
| eventstats sum(date_mday) as pom
| eval dmu=d/pom
| eval xdmu = if(date_wday==d, dmu * lc / d, dmu)
| fields + date_mday dmu xdmu

Hope this will help!

0 Karma

sideview
SplunkTrust
SplunkTrust

The code that's generating your exception and derailing your view is in the JSChart module. Specifically in its "sliceResultsBySeriesLength" method.

The good news is that Sideview Utils already patches a number of bugs and minor problems in JSChart, so if I can get a reproducible case here, I should be able to fix the core Splunk code so that it doesn't throw this error and it actually should be quite easy.

If there's any chance that you can create an analogous search that runs against index=_internal data, with the same HiddenChartFormatter and the same JSChart, such that it hits the same bug, that would be fantastic. Failing that if you can just send the view XML, and send an exported CSV of the exact search results that you're sending to the JSChart to be rendered, that will work great too.

After you post the link to pastebin or email me at nick [at] sideviewapps.com I should be able to track the bug and I can probably get a fix out in the next Utils release, and maybe find a workaround for you in the meantime.

You can and should of course also contact Splunk Support, and Splunk Support and Engineering are indisputably awesome. However bottom line I can probably get a fix out a bit faster.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...