Possible "Race Condition" From SPL code to Dashboard code running using lookuptables

[robertlynch2020]

Hi

A SPL line is retrieving data 100% all of the time, but it retrieves data 70% of the time when used as dashboard code "Test not found" pops up).

Its like the query did not run correctly and returns 0. its like there is a "race condition"

..any ideas would be great and thanks 🙂

<search>
    <!-- Search Test ID Details in SavedTest.csv-->
    <query>| inputlookup Saved_Tests.csv | where ID="$enter_saved_test_id$" | table ID, Host, Test_Name, Comments, Status, Start, Stop, Version, MX_Build_ID,  Log_or_Live</query>
            <earliest>0</earliest>
        <latest></latest>
    <done>
      <condition match="'job.resultCount'==0">
        <set token="form.enter_saved_test_id">Test not found</set>
      </condition>
      <condition>
        <unset token="execute_save_test"></unset>
        <unset token="save_test"></unset>
        <set token="host_token">$result.Host$</set>
        <set token="form.host_token">$result.Host$</set>
        <set token="form.time_token.earliest">$result.Start$</set>
        <set token="form.time_token.latest">$result.Stop$</set>
        <eval token="form.save_test_status">$result.Status$</eval>
        <set token="form.save_test_name_token">$result.Test_Name$</set>
        <set token="form.save_test_comments">$result.Comments$</set>
        <set token="saved_test_id">$result.ID$</set>
      </condition>
    </done>
  </search>

[tomsterkw]

Hi Robert,

Might be a bit different method to attack this but try the following:

1. Ensure you have a valid input tag:

   Test ID
   

2. Pipe it to a panel:

   
   
   
   | inputlookup append=true Saved_Tests.csv WHERE
   (ID="$enter_saved_test_id$")
   
   
   10
   none
   cell
   preview
   false
   false
   

[the_wolverine]

Did you know you could just do
| inputlookup Saved_Tests.csv where ID="$enter_saved_test_id$ | .... etc
I'm not sure but this may speed up your search, vs loading the entire lookup file and then whittling it down after.

[woodcock]

The problem has to be related to how enter_saved_test_id is being set. Show all of the other XML, especially the form inputs.

[robertlynch2020]

Hi Woodcook

This is a funny one, sometimes is happens a lot and other times it does not happen as much. So i as startign to think is it to do with other verabiles not just the dashboard code..

Below is how i set the enter_saved_test_id - a simple input.

  </input>
        <input type="text" token="enter_saved_test_id" searchWhenChanged="true">
          <label>Enter an existing SPLUNK_ID</label>
        </input>

[niketn]

@robertlynch2020 how many records are present in your lookup? Can you test with the following query?

| inputlookup Saved_Tests.csv where ID="$enter_saved_test_id$" 
| table ID, Host, Test_Name, Comments, Status, Start, Stop, Version, MX_Build_ID,  Log_or_Live

How is the token $enter_saved_test_id$ being set? Can you share that piece of code as well?
What are the two unset tokens used for and also how are you testing whether search returned results in Dashboard or not?

[robertlynch2020]

HI

I have removed some of the tokens that were not been used, but the issue can still happen - But not as frequent.

<form script="table_cell_highlighting.js,table_cell_highlighting1.js" hideFilters="true" refresh="30">
  <label>KPI_MONITORING</label>
  <description>Last 12 Hours  by default (Auto Refresh 30 seconds)</description>
  <search>
    <!-- Search Test ID Details in SavedTest.csv-->
    <query>| inputlookup Saved_Tests.csv | where ID="$enter_saved_test_id$" | table ID, Host, Test_Name, Comments, Status, Start, Stop, Version, MX_Build_ID,  Log_or_Live</query>
    <earliest>0</earliest>
    <latest></latest>
    <done>
      <condition match="'job.resultCount'==0">
        <set token="form.enter_saved_test_id">Test not found</set>
      </condition>
      <condition>

        <set token="form.time_token.earliest">$result.Start$</set>
        <set token="form.time_token.latest">$result.Stop$</set>

      </condition>
    </done>
  </search>
  <fieldset submitButton="false">
    <input type="time" token="time_token">
      <label></label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
    <input type="text" token="enter_saved_test_id" searchWhenChanged="true">
      <label>Enter an existing SPLUNK_ID</label>
    </input>
  </fieldset>