Why does a single single-value panel cause SplunkJS exception "Cannot read properly 'length' of undefined" in Splunk 6.3.0

[smichalski]

Hi everybody,

While checking our dashboards for migration to Splunk 6.3.0, I faced an issue with the redesigned single-value elements which truly base on a "single" value. Setting the numberPrecision option to another value than default (= 0) seems to cause a SplunkJS error that breaks the dashboard.

For tracking down the issue, I ended up on using the "simple_single" dashboard from the dashboard examples v4.0. Within that dashboard, we find an example for a single-value element without decorations:

<single>
  <title>No decorations</title>
  <search>
    <query>index=_internal | timechart count</query>
    <earliest>-24h@h</earliest>
    <latest>now</latest>
  </search>
  <option name="colorBy">value</option>
  <option name="colorMode">none</option>
  <option name="numberPrecision">0</option>
  <option name="showTrendIndicator">0</option>
  <option name="showSparkline">0</option>
  <option name="useColors">0</option>
  <option name="useThousandSeparators">1</option>
  <option name="linkView">search</option>
  <option name="drilldown">none</option>
</single>

If I just change numberPrecision to "0.00" the dashboard works fine. If I add an | head 1 to the search, the dashboard breaks. When changing to | head 2 and larger, the dashboard works again. Unfortunately, we designed most of our single value searches to return just one value, in order to avoid Splunk displaying the wrong one.

Error messages of browsers:

Chrome 46.0.2490.71 JS console: "Uncaught TypeError: Cannot read property 'length' of undefined"
Firefox 41.0.2 JS console: "TypeError: C.split(...)[1] is undefined mvc.js:6:2048500"

Am I configuring anything wrong or am I facing a bug here?

Cheers, Sven

[frobinson_splun]

Hi again, @smichalski,
We're looking at your query and have a suggestion. Could you give some more details on what you wanted the query to do? Specifically, how would you like "timechart" and "head" to work for you in this query? I see that "showSparkline" and "showTrendIndicator" are false in the simpleXML options, so there might be other query options we can suggest, depending on the single value visualization you want.

Relatedly, if you use "timechart count", the query aggregates to a single value. Piping to "head 1" before and/or after that could cause some of the issues you are seeing.

If you try this:
"index=_internal | timechart count"
or
"index=_internal | head 2| timechart count"
or
"index=_internal | stats count"
"index =_internal | stats values()"
(the above queries with the "stats" command will not create a sparkline or trend indicator)

Do either of these queries yield the results you want? Let me know how this works.

Thanks,
@frobinson_splunk

[rahulrawlani]

Hello,

I am also saming the same issue while using the Single Value chart to display trendz for a field (which returns value with precision) and _time used within the query.

The issue remains only in Chrome and not with Safari and Firefox. Post loading the dashboard, few panels which take a bit longer to run, keep displaying "Loading Results"...

Do we have any solution for this issue.
I am using Splunk version 6.3.3

[smichalski]

Hi frobinson_splunk, the query above is just an example to make reproduction of the issue easy 🙂 The actual issue we ran into after testing upgrading from Splunk 6.1.1 to 6.3.0 was the following:

Imagine an (HTML) dashboard containing multiple postprocessing searches. The base searches deliver multidimensional longterm data (e. g. via | WHERE _time >= relative_time(now(),"-3mon@mon") AND _time < relative_time(now(),"-0mon@mon") | bucket _time span=1d | stats count by _time, country, service, return_code), from which postprocessing searches draw their charts (e. g. | timechart span=1d sum(count) by service)). Parallely, there are postprocessing searches which grab the base search's result to only display an overall value of the last month as a single value element (e. g. | WHERE service="foo" | WHERE _time >= relative_time(now(),"-1mon@mon") AND _time < relative_time(now(),"-0mon@mon") | timechart span=1mon sum(count) as count)). That way, the result table for the single value will lead to a single row containing a _time column and a count column.

In 6.1, this approach of limiting the time range worked fine. Since 6.3.0 (or 6.2, I cannot tell), it produces a SplunkJS exception when adding the numberPrecision option and changing its value to "0.00". The issue seems to be related to the _time column: When that column is removed (e. g. by | fields - _time) or not passed on (e. g. by using | stats sum(count) as count), the single value elements gets displayed. So yes, removing _time works as a solution 🙂 Though I still need getting used to that implementation. It's strange that you don't have to remove the _time column when leaving the numberPrecision to default ("0").

Another solution would be turning the result into a string (index=_internal | timechart count | head 1 | eval count=round(count/1000000,2) . " Mio."). But then the numberPrecision option has no effect of course ...

[frobinson_splun]

Thanks for the additional details, @smichalski! Passing them along to our engineering team.

[frobinson_splun]

Also, separately from troubleshooting your query, we've filed a bug for the JS error you are seeing. Thanks for pointing this out!
Best,
@frobinson_splunk

[smichalski]

Oh, I hadn't seen your answer before sending my comment above. Thanks for providing some clarity!

[frobinson_splun]

Hi @smichalski,
I'm going to run this by our engineering team to see what we can suggest. Stay tuned!
@frobinson_splunk