Error in form search: Encountered an error while reading file '/opt/splunk/var/run/splunk/dispatch/1277454683.1/prereport_0.csv.gz'.

[kalitbri]

Hello,

I encountered errors which made some of my flash charts in form shows:

Results Error:

400 - Encountered an error while reading file

'/opt/splunk/var/run/splunk/dispatch/1277454683.1/prereport_0.csv.gz'.

Above the broken flash charts it displays "No results found."

I clicked "More Info ..." link and the popup page (normally should be Job Inspector page) shows:

500 Internal Server Error

KeyError: 'performance'

This page was linked to from http://xxxxxxxx:8000/en-US/app/search/aaa_test.

And the top of the form page displays:

Encountered an error while reading file '/opt/splunk/var/run/splunk/dispatch/1277454683.1/prereport_0.csv.gz'.

The timestamp directory part in the file changes in each attemept.

I checked the log and found some related entries to error code 400 in web_service.log:

...

web_service.log:BadRequest: [HTTP 400] Bad Request; [{'text': "Encountered an error while reading file '/opt/splunk/var/run/splunk/dispatch/1277454683.1/prereport_0.csv.gz'.", 'code': None, 'type': 'FATAL'}]

web_service.log:2010-06-25 08:31:51,690 ERROR [4c246977afa96cdec] proxy:70 - [HTTP 400] Bad Request; [{'text': "Encountered an error while reading file '/opt/splunk/var/run/splunk/dispatch/1277454683.1/prereport_0.csv.gz'.", 'code': None, 'type': 'FATAL'}]

...

But I can't find any related log to error code 500.

Can anyone give me a hint or two? Thanks!

[jrodman]

I've been told that this prereport_0 error is a known issue in 4.1.3 to be fixed in 4.1.4, but I've not been told what the problem is.

---

Updated, with better info:

It seems this is SPL-31791 "when 2 searches share a subsearch, error can result". Apparently this happens to do with two copies of a similar subsearch being launched at a close point in time, typically when a dashboard has the same subsearch used in two charts. A clumsy workaround might be to slightly modify one of the subsearches. It might be possible that two users hitting the same page might cause this though, for which I have no workaround

[kalitbri]

is there any chance to have any workaround before the fix is available?