bug with HiddenSavedSearch : not found / sideview editor freezing

[sbsbb]

I use a HiddenSavedSearch. The search is run by the scheduler, and returns results, but the View is complaining it can't find the view.
When its the case, its impossible to change anything in the Sideview editor, everything is like frozen.

[sideview · Accepted solution]

I can reproduce this problem and it looks like you're having two problems.

1) From that view in that app, the savedsearch, or maybe just its history, for some reason cannot be seen. This may have to do with sharing on the saved search, or permissions on the search, or with capabilities on your user account or role. It is a bit strange though and you might have to contact Splunk support.

2) Secondarily there is a bug in Splunk's HiddenSavedSearch module. This is what is freezing the page and locking up the Sideview Editor.

Skipping to the end, the short fix is to use the Sideview SavedSearch module in place of HiddenSavedSearch. It'll work the same in that it'll still complain that no scheduled job exists (see #1 above), but it wont throw an exception that freezes the view, and thus it wont freeze the Sideview Editor.

Details:
Both the SavedSearch module and the HiddenSavedSearch module detect that there is no scheduled job for this saved search, and they both send messages to the UI. However where the savedSearch module obeys module framework convention and sends a Context downstream that has a Search object in it, the HiddenSavedSearch sends down a Context with no search in it at all. Then when pretty much any downstream module tries to access the search, there isn't one and this can cause any number of exceptions to be thrown in various downstream modules.

I'll send an email to Splunk support because it's an easy thing for them to fix but in the short term just use the Sideview SavedSearch module instead of HiddenSavedSearch.

[sbsbb]

Thanks, I've change the module type, and try to open a case via our provider for 1)