topic Re: How to see if a search module is working, how to debug ? in All Apps and Add-ons

How to see if a search module is working, how to debug ?

sbsbb — Mon, 28 Sep 2020 13:42:02 GMT

I've a search module as child of a table for drilldown.
The table that should display the result ist empty... Is there a way to display the search string from the nested search somehow ?

I was not able the module that is used by Splunk-Search for "View results" in Sideview ?

Here is the debug output of the table element after the search is run, and before I click a row:
Debug Module : Table_0_5_0
Search values added/modified for downstream modules
(none)
Normal keys added/modified for downstream modules
(none)
Search values inherited from upstream
search | dbquery "test" "SELECT SOMETHING"
timerange over all time
search id 1365677693.860
Normal keys inherited from upstream
bpuic.element [object Object]
bpuic.rawValue 8503130
bpuic.value 8503130
bpuic 8503130

Debug output from the search under the table:
Debug Module : Search_1_6_0
Search values added/modified for downstream modules
search index=t_cus | head 1
Normal keys added/modified for downstream modules
(none)
Search values inherited from upstream
search | dbquery "kivdv_test" "SELECT TO_CHAR(l.ROW_ERF_TSTAMP,'YYYY-MM-DD HH24:mm:SS-FF'),BETRIEBSTAG,k.fahrt_bezeichner,k.vmnummer,k.start_bpuic,k.end_bpuic,l.* FROM KIVDV_PRODPLAN.VM_VDV k JOIN KIVDV_PRODPLAN.VM_FAHRT_PUNKT_VDV l ON k.ID=l.VM_VDV_ID WHERE BPUIC=8503130"
timerange over all time
Normal keys inherited from upstream
bpuic.element [object Object]
bpuic.rawValue 8503130
bpuic.value 8503130
bpuic 8503130

Code from the entire view:

VDV Datenbank Abfrage

  <module name="AccountBar" layoutPanel="appHeader" />

  <module name="AppBar" layoutPanel="appHeader" />

  <module name="SideviewUtils" layoutPanel="appHeader" />

  <module name="Message" layoutPanel="messaging">
    <param name="filter">*</param>
    <param name="maxSize">2</param>
    <param name="clearOnJobDispatch">False</param>
  </module>

  <module name="HTML" layoutPanel="viewHeader">
    <param name="html"><![CDATA[
        <h1>VDV Datenbank Suche</h1>

]]></param>

    <module name="TextField" layoutPanel="mainSearchControls">
      <param name="default">8503130</param>
      <param name="label">BPUIC</param>
      <param name="name">bpuic</param>

      <module name="TimeRangePicker">
        <param name="searchWhenChanged">False</param>

        <module name="Button">
          <param name="label">Search</param>

          <module name="Search">
            <param name="search"><![CDATA[
| dbquery "kivdv_test"
"SELECT TO_CHAR(l.ROW_ERF_TSTAMP,'YYYY-MM-DD HH24:mm:SS-FF'),BETRIEBSTAG,k.fahrt_bezeichner,k.vmnummer,k.start_bpuic,k.end_bpuic,l.*  FROM KIVDV_PRODPLAN.VM_VDV k JOIN KIVDV_PRODPLAN.VM_FAHRT_PUNKT_VDV l ON k.ID=l.VM_VDV_ID WHERE BPUIC=$bpuic$"




]]></param>

            <module name="Table">

              <module name="Search">
                <param name="earliest">0</param>
                <param name="search"><![CDATA[
index=t_cus | head 1










]]></param>

                <module name="Table" layoutPanel="panel_row1_col1" />

                <module name="SimpleResultsTable" layoutPanel="panel_row1_col2" />

                <module name="PostProcess">
                  <param name="search">
search AB_ERW=1365494922.000
</param>

                  <module name="Table" layoutPanel="panel_row1_col1" />
                </module>

                <module name="JobStatus" />

                <module name="HTML">
                  <param name="html">
&lt;h3&gt;DEBUGGING&lt;/h3&gt;
&lt;b&gt;search:&lt;/b&gt; $search$&lt;br&gt;
&lt;b&gt;postProcess:&lt;/b&gt; $postProcess$&lt;br&gt;
&lt;b&gt;username:&lt;/b&gt; $row.fields.username$&lt;br&gt;


</param>
                </module>
              </module>

              <module name="HTML">
                <param name="html"><![CDATA[
<h3>DEBUGGING</h3>
<b>search:</b> $search$<br>
<b>postProcess:</b> $postProcess$<br>
<b>username:</b> $row.fields.username$<br>
$row.fields.VMNUMMER$<br>
$row.fields.VIA$
]]></param>
              </module>
            </module>
          </module>
        </module>
      </module>
    </module>
  </module>
</view>

Re: How to see if a search module is working, how to debug ?

sideview — Tue, 09 Apr 2013 23:05:16 GMT

The easiest way is to just throw an HTML module in there and print out the $search$ token.

<module name="HTML">
  <param name="html"><![CDATA[
    <h3>DEBUGGING</h3>
    <b>search:</b> $search$
  ]]></param>
</module>

You can also throw one of these beneath table or chart drilldown configs and this can be a great simple way to debug why things aren't working the way you expect.

<module name="HTML">
  <param name="html"><![CDATA[
    <h3>DEBUGGING</h3>
    <b>search:</b> $search$<br>
    <b>postProcess:</b> $postProcess$<br>
    <b>username:</b> $row.fields.username$<br>
  ]]></param>
</module>

However you can also use the "Runtime Debug" mode of the Sideview Editor, which is an extremely powerful tool, and which will show you all of the keys passing downstream through any given point in the view. Using an HTML module is better for tactical debugging, and at the most complex part of a view I frequently leave one their commented out (what's useful debugging today's problem will be used again tomorrow). But the Runtime Debug can be useful to discover what other keys are there for you to use... And remember to update Sideview Utils because there's a lot of documentation in there about what keys are there.

http://sideviewapps.com/apps/sideview-utils

Re: How to see if a search module is working, how to debug ?

sbsbb — Wed, 10 Apr 2013 06:06:13 GMT

I don't know if its a bug, but I none of the variable are set, after my table (the table is based on a dbquery-search) :

I have :
Search(dbquery)
|
Table (displaying results)
|
Html (all variables empty)

I have exact the same structure on a "normal search", and I get $row.fieds.*$ variables returned ?

Re: How to see if a search module is working, how to debug ?

sideview — Wed, 10 Apr 2013 15:12:35 GMT

Can you check that you have the SideviewUtils module up at the top of the page? If that's not there then you're page will have a Fatal Javascript error, although parts of it might work enough to make you think that the page is working. Are you saying the $search$ variable itself is blank? Pretty much only a fatal JS error could have done that.

Re: How to see if a search module is working, how to debug ?

sbsbb — Thu, 11 Apr 2013 10:52:45 GMT

There is no JS error, html after search is displaying the $search$
But on the html after the table, $row.fields.[fieldname] is not displaying anything... $search$ is also empty

I've but the debug output of the table element in description. After clicking a row, I can't see the debug from the Table element...
Elements under that table, haven't any key from the column of that table

Is there a limitation by dbquery that data cannot be used in underlying elements ?

Re: How to see if a search module is working, how to debug ?

sideview — Thu, 11 Apr 2013 17:00:43 GMT

And just to double check, when you're debugging it like this, it is always after you have clicked one of the Table rows to select it, right? If there's no selected yellow row in the Table then the module will add no keys to the search, and actually that's pretty much the only way that can happen (as in that Runtime Debug output you posted)

Re: How to see if a search module is working, how to debug ?

sbsbb — Mon, 15 Apr 2013 16:18:07 GMT

Yes one row is selected.
I know it is pretty strange, thats why I'm wondering if it is not linked to the dbquery ?

I'm using drilldown successfully on 10 other places without problem.

I've posted, output from table, and search under the table, as well as the entire code.

Re: How to see if a search module is working, how to debug ?

sideview — Tue, 16 Apr 2013 18:21:38 GMT

Well, once you have eliminated the impossible... I'll check out DB Connect to see if maybe search results returned from its searches have some odd characteristics, that somehow dont trigger JS errors, but do disrupt the drilldown functionality. I'll let you know.

Re: How to see if a search module is working, how to debug ?

sbsbb — Fri, 19 Apr 2013 09:03:19 GMT

Hi nick, I've changed the select for simple one, and after that it works... (maybe problem because of the TO_CHAR ?)

Re: How to see if a search module is working, how to debug ?

sideview — Fri, 19 Apr 2013 16:38:26 GMT

Oh that might make sense. If that is able to change the API output such that some characters are actually in the wrong encoding, yea I can imagine things could quietly fail with no error message logged. I'm still working on getting DB Connect set up locally to test, but I'll try and confirm when I do and I'll ping the owner of DB Connect to let him know the hypothesis.

Re: How to see if a search module is working, how to debug ?

Dan — Mon, 22 Apr 2013 17:43:42 GMT

I'm the owner of DB Connect. Try turning on debug logging (http://docs.splunk.com/Documentation/DBX/latest/DeployDBX/javaspec) and see what SQL actually gets executed on drilldown.

Re: How to see if a search module is working, how to debug ?

sideview — Mon, 22 Apr 2013 18:36:27 GMT

As a sanity check, can you confirm that you intend the drilldown search to not involve any values or anything at all from the dbconnect search? The drilldown search here will search for index=t_cus | head 1, over the timerange specified by the TimeRangePicker. If that returns zero results, then the drilldown table will never show any results. I have been assuming that your index=t_cus | head 1 search is itself a test-search, and that you know that there's at least one event from the t_cus index within the timerange selected by the TimeRangePicker, but i'm just checking.