JavaScript code receiving erroneous information from Splunk Query

[adnankhan5133]

We’re encountering an odd issue with regards to how our Splunk Dashboard query is passing values to the JavaScript code being invoked within the dashboard’s source code.

To provide you with an example, our dashboard SPL query is generating the correct values. Here is a sample output:

Transaction Name	June 2020 - Count	July 2020 - Count	August 2020 - Count
Employee Batch	2400	3200	2900
Supervisor Batch	2100	2800	2500

However, the JavaScript file is correctly picking up all the values except for the last column’s values, which it receives as a value of “0” from the Splunk query.

Transaction Name	June 2020 - Count	July 2020 - Count	August 2020 - Count
Employee Batch	2400	3200	0
Supervisor Batch	2100	2800	0

This results in the dashboard displaying the values captured by the JavaScript code, which makes the last column display the incorrect data.

Transaction Name	June 2020 - Count	July 2020 - Count	August 2020 - Count
Employee Batch	2400	3200	0
Supervisor Batch	2100	2800	0

There does not appear to be any hard-coding of values in the SPL query, so we’re rather confused as to how or why the JavaScript code would misinterpret the values of just one column, while correctly interpreting the values of all the other columns.

Would you have any ideas on how to proceed here? We tried researching this issue online but were unable to identify any helpful information.

[niketn]

@adnankhan5133 for the community to assist you better can you please add details of what you SPL you have in SimpleXML vs what is your code for SearchManager in the JS? Also the user case for running Search through JS instead of SimpleXML?

[adnankhan5133]

For reference, included below is the current JavaScript code which is written to only get an instance of the search query and not manipulate data in any manner.

While looking through myResults, the following is what we received for 8/13. Index 12 for both Rows 0 and 1 are indicating a value of 0 for the row, rather than a non-zero value. The data that I included in my original question included mocked up data.

The question that we are trying to answer here is why Index 12 is picking up a value of zero rather than a non-zero value. 

The use case for leveraging JS alongside Splunk here is because we need to color-code certain cells that fall within or outside a certain threshold. While we could use the dashboard's in-line SimpleXML source code and hard-code the values, we are trying to achieve this via a more programmatic approach and JS appears to have been helping out so far.