All Apps and Add-ons

Choropleth crashes splunkd 6.3.2 with custom .kmz

ololdach
Builder

Hi fellow splunkers! I've come across something annoying and would like to rule out my own stupidity as a root cause... so please do help me... I really do appreciate it:

I run the following search:
index=* Sell_to_Post_Code=8* | stats sum(Line_Amount) by Sell_to_Post_Code, Sell_to_Customer_Name | eval featureId=substr(Sell_to_Post_Code,1,1) | geom geo_de_plz_1

The kmz file was built with qgis from a shp file according to the tips from Michael Porath and has the corresponding names set. The search statistics return the right featureId and featureCollection. The returned geoms look fine as well, giving lat/lon paths in the southern part of Germany.

However, the visualization stays blank and when I zoom in to the respective area, Splunk dies very unceremoneously with the following error being logged:

ERROR spatial:ClipRect - Subject or clip had odd number of intersections subj: 11, clip: 11
03-19-2016 09:39:43.642 +0100 ERROR spatial:ClipRect - Dumping info on offending subject:
03-19-2016 09:39:43.642 +0100 ERROR spatial:ClipRect - BoundaryPoint(Point x:8.680075 y:54.367760, entry=0, intersection=1, dot=0.000000, vertexId=17, segmentId111630 polygonId=68)\nBoundaryPoint(Point x:8.677596 y:54.367760, entry=0, intersection=1, dot=0.000000, vertexId=18, segmentId111666 polygonId=68)\nBoundaryPoint(Point x:8.651194 y:54.367760, entry=0, intersection=1, dot=0.000000, vertexId=19, segmentId111708 polygonId=68)\nBoundaryPoint(Point x:8.642137 y:54.367760, entry=0, intersection=1, dot=0.000000, vertexId=20, segmentId111722 polygonId=68)\nBoundaryPoint(Point x:10.153419 y:54.367760, entry=0, intersection=1, dot=0.000008, vertexId=21, segmentId115946 polygonId=68)\nBoundaryPoint(Point x:10.196551 y:54.367760, entry=0, intersection=1, dot=0.000000, vertexId=22, segmentId116141 polygonId=68)\nBoundaryPoint(Point x:10.592367 y:54.367760, entry=0, intersection=1, dot=0.003107, vertexId=23, segmentId116404 polygonId=68)\nBoundaryPoint(Point x:10.900229 y:54.367760, entry=0, intersection=1, dot=0.000894, vertexId=24, segmentId116500 polygonId=68)\nBoundaryPoint(Point x:11.022176 y:54.367760, entry=0, intersection=1, dot=0.000000, vertexId=25, segmentId116539 polygonId=68)\nBoundaryPoint(Point x:11.025134 y:54.367760, entry=0, intersection=1, dot=0.000003, vertexId=26, segmentId116541 polygonId=68)\nBoundaryPoint(Point x:11.110953 y:54.367760, entry=0, intersection=1, dot=0.000003, vertexId=27, segmentId116838 polygonId=68)\n

Any ideas?
Oliver

0 Karma
1 Solution

ololdach
Builder

Solved it: Please make sure that you have exactly one result per featureId. If you have more than one event per featureId it means trouble. Note for the Splunk team: Maybe you'd like to catch this in your code, because almost anybody can crash the Splunk instance by issuing a search with Choropleth visualization.

View solution in original post

0 Karma

ololdach
Builder

Solved it: Please make sure that you have exactly one result per featureId. If you have more than one event per featureId it means trouble. Note for the Splunk team: Maybe you'd like to catch this in your code, because almost anybody can crash the Splunk instance by issuing a search with Choropleth visualization.

0 Karma