topic Re: Possible "Race Condition" From SPL code to Dashboard code running using lookuptables in Splunk Search

Possible "Race Condition" From SPL code to Dashboard code running using lookuptables

robertlynch2020 — Mon, 21 Jan 2019 12:17:23 GMT

A SPL line is retrieving data 100% all of the time, but it retrieves data 70% of the time when used as dashboard code "Test not found" pops up).

Its like the query did not run correctly and returns 0. its like there is a "race condition"

..any ideas would be great and thanks 🙂

<search>
    <!-- Search Test ID Details in SavedTest.csv-->
    <query>| inputlookup Saved_Tests.csv | where ID="$enter_saved_test_id$" | table ID, Host, Test_Name, Comments, Status, Start, Stop, Version, MX_Build_ID,  Log_or_Live</query>
            <earliest>0</earliest>
        <latest></latest>
    <done>
      <condition match="'job.resultCount'==0">
        <set token="form.enter_saved_test_id">Test not found</set>
      </condition>
      <condition>
        <unset token="execute_save_test"></unset>
        <unset token="save_test"></unset>
        <set token="host_token">$result.Host$</set>
        <set token="form.host_token">$result.Host$</set>
        <set token="form.time_token.earliest">$result.Start$</set>
        <set token="form.time_token.latest">$result.Stop$</set>
        <eval token="form.save_test_status">$result.Status$</eval>
        <set token="form.save_test_name_token">$result.Test_Name$</set>
        <set token="form.save_test_comments">$result.Comments$</set>
        <set token="saved_test_id">$result.ID$</set>
      </condition>
    </done>
  </search>

Re: Possible "Race Condition" From SPL code to Dashboard code running using lookuptables

niketn — Mon, 21 Jan 2019 16:11:37 GMT

@robertlynch2020 how many records are present in your lookup? Can you test with the following query?

| inputlookup Saved_Tests.csv where ID="$enter_saved_test_id$" 
| table ID, Host, Test_Name, Comments, Status, Start, Stop, Version, MX_Build_ID,  Log_or_Live

How is the token $enter_saved_test_id$ being set? Can you share that piece of code as well?
What are the two unset tokens used for and also how are you testing whether search returned results in Dashboard or not?

Re: Possible "Race Condition" From SPL code to Dashboard code running using lookuptables

woodcock — Mon, 21 Jan 2019 17:42:30 GMT

The problem has to be related to how enter_saved_test_id is being set. Show all of the other XML, especially the form inputs.

Re: Possible "Race Condition" From SPL code to Dashboard code running using lookuptables

robertlynch2020 — Tue, 22 Jan 2019 12:12:29 GMT

I have removed some of the tokens that were not been used, but the issue can still happen - But not as frequent.

<form script="table_cell_highlighting.js,table_cell_highlighting1.js" hideFilters="true" refresh="30">
  <label>KPI_MONITORING</label>
  <description>Last 12 Hours  by default (Auto Refresh 30 seconds)</description>
  <search>
    <!-- Search Test ID Details in SavedTest.csv-->
    <query>| inputlookup Saved_Tests.csv | where ID="$enter_saved_test_id$" | table ID, Host, Test_Name, Comments, Status, Start, Stop, Version, MX_Build_ID,  Log_or_Live</query>
    <earliest>0</earliest>
    <latest></latest>
    <done>
      <condition match="'job.resultCount'==0">
        <set token="form.enter_saved_test_id">Test not found</set>
      </condition>
      <condition>

        <set token="form.time_token.earliest">$result.Start$</set>
        <set token="form.time_token.latest">$result.Stop$</set>

      </condition>
    </done>
  </search>
  <fieldset submitButton="false">
    <input type="time" token="time_token">
      <label></label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
    <input type="text" token="enter_saved_test_id" searchWhenChanged="true">
      <label>Enter an existing SPLUNK_ID</label>
    </input>
  </fieldset>

Re: Possible "Race Condition" From SPL code to Dashboard code running using lookuptables

robertlynch2020 — Tue, 29 Sep 2020 22:51:47 GMT

Hi Woodcook

This is a funny one, sometimes is happens a lot and other times it does not happen as much. So i as startign to think is it to do with other verabiles not just the dashboard code..

Below is how i set the enter_saved_test_id - a simple input.

  </input>
        <input type="text" token="enter_saved_test_id" searchWhenChanged="true">
          <label>Enter an existing SPLUNK_ID</label>
        </input>

Re: Possible "Race Condition" From SPL code to Dashboard code running using lookuptables

the_wolverine — Tue, 29 Sep 2020 22:56:50 GMT

Did you know you could just do
| inputlookup Saved_Tests.csv where ID="$enter_saved_test_id$ | .... etc
I'm not sure but this may speed up your search, vs loading the entire lookup file and then whittling it down after.

Re: Possible "Race Condition" From SPL code to Dashboard code running using lookuptables

tomsterkw — Tue, 29 Sep 2020 22:58:52 GMT

Hi Robert,

Might be a bit different method to attack this but try the following:

Ensure you have a valid input tag:

Test ID
Pipe it to a panel:

Search

| inputlookup append=true Saved_Tests.csv WHERE
(ID="$enter_saved_test_id$")

10
none
cell
preview
false
false