Choropleth crashes splunkd 6.3.2 with custom .kmz

[ololdach]

Hi fellow splunkers! I've come across something annoying and would like to rule out my own stupidity as a root cause... so please do help me... I really do appreciate it:

I run the following search:
index=* Sell_to_Post_Code=8* | stats sum(Line_Amount) by Sell_to_Post_Code, Sell_to_Customer_Name | eval featureId=substr(Sell_to_Post_Code,1,1) | geom geo_de_plz_1

The kmz file was built with qgis from a shp file according to the tips from Michael Porath and has the corresponding names set. The search statistics return the right featureId and featureCollection. The returned geoms look fine as well, giving lat/lon paths in the southern part of Germany.

However, the visualization stays blank and when I zoom in to the respective area, Splunk dies very unceremoneously with the following error being logged:

ERROR spatial:ClipRect - Subject or clip had odd number of intersections subj: 11, clip: 11
03-19-2016 09:39:43.642 +0100 ERROR spatial:ClipRect - Dumping info on offending subject:
03-19-2016 09:39:43.642 +0100 ERROR spatial:ClipRect - BoundaryPoint(Point x:8.680075 y:54.367760, entry=0, intersection=1, dot=0.000000, vertexId=17, segmentId111630 polygonId=68)\nBoundaryPoint(Point x:8.677596 y:54.367760, entry=0, intersection=1, dot=0.000000, vertexId=18, segmentId111666 polygonId=68)\nBoundaryPoint(Point x:8.651194 y:54.367760, entry=0, intersection=1, dot=0.000000, vertexId=19, segmentId111708 polygonId=68)\nBoundaryPoint(Point x:8.642137 y:54.367760, entry=0, intersection=1, dot=0.000000, vertexId=20, segmentId111722 polygonId=68)\nBoundaryPoint(Point x:10.153419 y:54.367760, entry=0, intersection=1, dot=0.000008, vertexId=21, segmentId115946 polygonId=68)\nBoundaryPoint(Point x:10.196551 y:54.367760, entry=0, intersection=1, dot=0.000000, vertexId=22, segmentId116141 polygonId=68)\nBoundaryPoint(Point x:10.592367 y:54.367760, entry=0, intersection=1, dot=0.003107, vertexId=23, segmentId116404 polygonId=68)\nBoundaryPoint(Point x:10.900229 y:54.367760, entry=0, intersection=1, dot=0.000894, vertexId=24, segmentId116500 polygonId=68)\nBoundaryPoint(Point x:11.022176 y:54.367760, entry=0, intersection=1, dot=0.000000, vertexId=25, segmentId116539 polygonId=68)\nBoundaryPoint(Point x:11.025134 y:54.367760, entry=0, intersection=1, dot=0.000003, vertexId=26, segmentId116541 polygonId=68)\nBoundaryPoint(Point x:11.110953 y:54.367760, entry=0, intersection=1, dot=0.000003, vertexId=27, segmentId116838 polygonId=68)\n

Any ideas?
Oliver

[ololdach · Accepted solution]

Solved it: Please make sure that you have exactly one result per featureId. If you have more than one event per featureId it means trouble. Note for the Splunk team: Maybe you'd like to catch this in your code, because almost anybody can crash the Splunk instance by issuing a search with Choropleth visualization.