All Apps and Add-ons

How to see if a search module is working, how to debug ?

sbsbb
Builder

I've a search module as child of a table for drilldown.
The table that should display the result ist empty... Is there a way to display the search string from the nested search somehow ?

I was not able the module that is used by Splunk-Search for "View results" in Sideview ?

Here is the debug output of the table element after the search is run, and before I click a row:
Debug Module : Table_0_5_0
Search values added/modified for downstream modules
(none)
Normal keys added/modified for downstream modules
(none)
Search values inherited from upstream
search | dbquery "test" "SELECT SOMETHING"
timerange over all time
search id 1365677693.860
Normal keys inherited from upstream
bpuic.element [object Object]
bpuic.rawValue 8503130
bpuic.value 8503130
bpuic 8503130

Debug output from the search under the table:
Debug Module : Search_1_6_0
Search values added/modified for downstream modules
search index=t_cus | head 1
Normal keys added/modified for downstream modules
(none)
Search values inherited from upstream
search | dbquery "kivdv_test" "SELECT TO_CHAR(l.ROW_ERF_TSTAMP,'YYYY-MM-DD HH24:mm:SS-FF'),BETRIEBSTAG,k.fahrt_bezeichner,k.vmnummer,k.start_bpuic,k.end_bpuic,l.* FROM KIVDV_PRODPLAN.VM_VDV k JOIN KIVDV_PRODPLAN.VM_FAHRT_PUNKT_VDV l ON k.ID=l.VM_VDV_ID WHERE BPUIC=8503130"
timerange over all time
Normal keys inherited from upstream
bpuic.element [object Object]
bpuic.rawValue 8503130
bpuic.value 8503130
bpuic 8503130

Code from the entire view:

  <module name="AccountBar" layoutPanel="appHeader" />

  <module name="AppBar" layoutPanel="appHeader" />

  <module name="SideviewUtils" layoutPanel="appHeader" />

  <module name="Message" layoutPanel="messaging">
    <param name="filter">*</param>
    <param name="maxSize">2</param>
    <param name="clearOnJobDispatch">False</param>
  </module>

  <module name="HTML" layoutPanel="viewHeader">
    <param name="html"><![CDATA[
        <h1>VDV Datenbank Suche</h1>

]]></param>

    <module name="TextField" layoutPanel="mainSearchControls">
      <param name="default">8503130</param>
      <param name="label">BPUIC</param>
      <param name="name">bpuic</param>

      <module name="TimeRangePicker">
        <param name="searchWhenChanged">False</param>

        <module name="Button">
          <param name="label">Search</param>

          <module name="Search">
            <param name="search"><![CDATA[
| dbquery "kivdv_test"
"SELECT TO_CHAR(l.ROW_ERF_TSTAMP,'YYYY-MM-DD HH24:mm:SS-FF'),BETRIEBSTAG,k.fahrt_bezeichner,k.vmnummer,k.start_bpuic,k.end_bpuic,l.*  FROM KIVDV_PRODPLAN.VM_VDV k JOIN KIVDV_PRODPLAN.VM_FAHRT_PUNKT_VDV l ON k.ID=l.VM_VDV_ID WHERE BPUIC=$bpuic$"




]]></param>

            <module name="Table">

              <module name="Search">
                <param name="earliest">0</param>
                <param name="search"><![CDATA[
index=t_cus | head 1










]]></param>

                <module name="Table" layoutPanel="panel_row1_col1" />

                <module name="SimpleResultsTable" layoutPanel="panel_row1_col2" />

                <module name="PostProcess">
                  <param name="search">
search AB_ERW=1365494922.000
</param>

                  <module name="Table" layoutPanel="panel_row1_col1" />
                </module>

                <module name="JobStatus" />

                <module name="HTML">
                  <param name="html">
&lt;h3&gt;DEBUGGING&lt;/h3&gt;
&lt;b&gt;search:&lt;/b&gt; $search$&lt;br&gt;
&lt;b&gt;postProcess:&lt;/b&gt; $postProcess$&lt;br&gt;
&lt;b&gt;username:&lt;/b&gt; $row.fields.username$&lt;br&gt;


</param>
                </module>
              </module>

              <module name="HTML">
                <param name="html"><![CDATA[
<h3>DEBUGGING</h3>
<b>search:</b> $search$<br>
<b>postProcess:</b> $postProcess$<br>
<b>username:</b> $row.fields.username$<br>
$row.fields.VMNUMMER$<br>
$row.fields.VIA$
]]></param>
              </module>
            </module>
          </module>
        </module>
      </module>
    </module>
  </module>
</view>

sideview
SplunkTrust
SplunkTrust

The easiest way is to just throw an HTML module in there and print out the $search$ token.

<module name="HTML">
  <param name="html"><![CDATA[
    <h3>DEBUGGING</h3>
    <b>search:</b> $search$
  ]]></param>
</module>

You can also throw one of these beneath table or chart drilldown configs and this can be a great simple way to debug why things aren't working the way you expect.

<module name="HTML">
  <param name="html"><![CDATA[
    <h3>DEBUGGING</h3>
    <b>search:</b> $search$<br>
    <b>postProcess:</b> $postProcess$<br>
    <b>username:</b> $row.fields.username$<br>
  ]]></param>
</module>

However you can also use the "Runtime Debug" mode of the Sideview Editor, which is an extremely powerful tool, and which will show you all of the keys passing downstream through any given point in the view. Using an HTML module is better for tactical debugging, and at the most complex part of a view I frequently leave one their commented out (what's useful debugging today's problem will be used again tomorrow). But the Runtime Debug can be useful to discover what other keys are there for you to use... And remember to update Sideview Utils because there's a lot of documentation in there about what keys are there.

http://sideviewapps.com/apps/sideview-utils

sideview
SplunkTrust
SplunkTrust

As a sanity check, can you confirm that you intend the drilldown search to not involve any values or anything at all from the dbconnect search? The drilldown search here will search for index=t_cus | head 1, over the timerange specified by the TimeRangePicker. If that returns zero results, then the drilldown table will never show any results. I have been assuming that your index=t_cus | head 1 search is itself a test-search, and that you know that there's at least one event from the t_cus index within the timerange selected by the TimeRangePicker, but i'm just checking.

0 Karma

Dan
Splunk Employee
Splunk Employee

I'm the owner of DB Connect. Try turning on debug logging (http://docs.splunk.com/Documentation/DBX/latest/DeployDBX/javaspec) and see what SQL actually gets executed on drilldown.

0 Karma

sideview
SplunkTrust
SplunkTrust

Oh that might make sense. If that is able to change the API output such that some characters are actually in the wrong encoding, yea I can imagine things could quietly fail with no error message logged. I'm still working on getting DB Connect set up locally to test, but I'll try and confirm when I do and I'll ping the owner of DB Connect to let him know the hypothesis.

0 Karma

sbsbb
Builder

Hi nick, I've changed the select for simple one, and after that it works... (maybe problem because of the TO_CHAR ?)

0 Karma

sideview
SplunkTrust
SplunkTrust

Well, once you have eliminated the impossible... I'll check out DB Connect to see if maybe search results returned from its searches have some odd characteristics, that somehow dont trigger JS errors, but do disrupt the drilldown functionality. I'll let you know.

0 Karma

sbsbb
Builder

Yes one row is selected.
I know it is pretty strange, thats why I'm wondering if it is not linked to the dbquery ?

I'm using drilldown successfully on 10 other places without problem.

I've posted, output from table, and search under the table, as well as the entire code.

0 Karma

sideview
SplunkTrust
SplunkTrust

And just to double check, when you're debugging it like this, it is always after you have clicked one of the Table rows to select it, right? If there's no selected yellow row in the Table then the module will add no keys to the search, and actually that's pretty much the only way that can happen (as in that Runtime Debug output you posted)

0 Karma

sbsbb
Builder

There is no JS error, html after search is displaying the $search$
But on the html after the table, $row.fields.[fieldname] is not displaying anything... $search$ is also empty

I've but the debug output of the table element in description. After clicking a row, I can't see the debug from the Table element...
Elements under that table, haven't any key from the column of that table

Is there a limitation by dbquery that data cannot be used in underlying elements ?

0 Karma

sideview
SplunkTrust
SplunkTrust

Can you check that you have the SideviewUtils module up at the top of the page? If that's not there then you're page will have a Fatal Javascript error, although parts of it might work enough to make you think that the page is working. Are you saying the $search$ variable itself is blank? Pretty much only a fatal JS error could have done that.

0 Karma

sbsbb
Builder

I don't know if its a bug, but I none of the variable are set, after my table (the table is based on a dbquery-search) :

I have :
Search(dbquery)
|
Table (displaying results)
|
Html (all variables empty)

I have exact the same structure on a "normal search", and I get $row.fieds.*$ variables returned ?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...