Splunk Search

Possible "Race Condition" From SPL code to Dashboard code running using lookuptables

robertlynch2020
Motivator

Hi

A SPL line is retrieving data 100% all of the time, but it retrieves data 70% of the time when used as dashboard code "Test not found" pops up).

Its like the query did not run correctly and returns 0. its like there is a "race condition"

..any ideas would be great and thanks 🙂

<search>
    <!-- Search Test ID Details in SavedTest.csv-->
    <query>| inputlookup Saved_Tests.csv | where ID="$enter_saved_test_id$" | table ID, Host, Test_Name, Comments, Status, Start, Stop, Version, MX_Build_ID,  Log_or_Live</query>
            <earliest>0</earliest>
        <latest></latest>
    <done>
      <condition match="'job.resultCount'==0">
        <set token="form.enter_saved_test_id">Test not found</set>
      </condition>
      <condition>
        <unset token="execute_save_test"></unset>
        <unset token="save_test"></unset>
        <set token="host_token">$result.Host$</set>
        <set token="form.host_token">$result.Host$</set>
        <set token="form.time_token.earliest">$result.Start$</set>
        <set token="form.time_token.latest">$result.Stop$</set>
        <eval token="form.save_test_status">$result.Status$</eval>
        <set token="form.save_test_name_token">$result.Test_Name$</set>
        <set token="form.save_test_comments">$result.Comments$</set>
        <set token="saved_test_id">$result.ID$</set>
      </condition>
    </done>
  </search>

alt text

0 Karma

tomsterkw
Engager

Hi Robert,

Might be a bit different method to attack this but try the following:

  1. Ensure you have a valid input tag:


  2. Pipe it to a panel:


    Search

    | inputlookup append=true Saved_Tests.csv WHERE
    (ID="$enter_saved_test_id$")


    10
    none
    cell
    preview
    false
    false

0 Karma

the_wolverine
Champion

Did you know you could just do
| inputlookup Saved_Tests.csv where ID="$enter_saved_test_id$ | .... etc
I'm not sure but this may speed up your search, vs loading the entire lookup file and then whittling it down after.

0 Karma

woodcock
Esteemed Legend

The problem has to be related to how enter_saved_test_id is being set. Show all of the other XML, especially the form inputs.

0 Karma

robertlynch2020
Motivator

Hi Woodcook

This is a funny one, sometimes is happens a lot and other times it does not happen as much. So i as startign to think is it to do with other verabiles not just the dashboard code..

Below is how i set the enter_saved_test_id - a simple input.

  </input>
        <input type="text" token="enter_saved_test_id" searchWhenChanged="true">
          <label>Enter an existing SPLUNK_ID</label>
        </input>
0 Karma

niketn
Legend

@robertlynch2020 how many records are present in your lookup? Can you test with the following query?

| inputlookup Saved_Tests.csv where ID="$enter_saved_test_id$" 
| table ID, Host, Test_Name, Comments, Status, Start, Stop, Version, MX_Build_ID,  Log_or_Live

How is the token $enter_saved_test_id$ being set? Can you share that piece of code as well?
What are the two unset tokens used for and also how are you testing whether search returned results in Dashboard or not?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

robertlynch2020
Motivator

HI

I have removed some of the tokens that were not been used, but the issue can still happen - But not as frequent.

<form script="table_cell_highlighting.js,table_cell_highlighting1.js" hideFilters="true" refresh="30">
  <label>KPI_MONITORING</label>
  <description>Last 12 Hours  by default (Auto Refresh 30 seconds)</description>
  <search>
    <!-- Search Test ID Details in SavedTest.csv-->
    <query>| inputlookup Saved_Tests.csv | where ID="$enter_saved_test_id$" | table ID, Host, Test_Name, Comments, Status, Start, Stop, Version, MX_Build_ID,  Log_or_Live</query>
    <earliest>0</earliest>
    <latest></latest>
    <done>
      <condition match="'job.resultCount'==0">
        <set token="form.enter_saved_test_id">Test not found</set>
      </condition>
      <condition>

        <set token="form.time_token.earliest">$result.Start$</set>
        <set token="form.time_token.latest">$result.Stop$</set>

      </condition>
    </done>
  </search>
  <fieldset submitButton="false">
    <input type="time" token="time_token">
      <label></label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
    <input type="text" token="enter_saved_test_id" searchWhenChanged="true">
      <label>Enter an existing SPLUNK_ID</label>
    </input>
  </fieldset>
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...