Developing for Splunk Enterprise

Infinite loop when there are no results using JSON output

andras_kerekes
Explorer

I am using Splunk 5.0.2 with Java SDK 1.1. If I run a search that does not return any result, and use the ResultReaderJson class to parse the result the com.splunk.ResultsReaderJson#readEvent method gets into an infinite loop and does not return.

The problem is that when Splunk tries to parse the following:

{"results":[{"count":0}]}

It starts reading the object starting at the {, it reads the count as name (in /com/splunk/ResultsReaderJson.java:287) then the next Json token is a JsonToken.NUMBER with the value 0, but the method does not handle it, it expects only *_START/ *_END, NAME and STRING tokens.

1 Solution

andras_kerekes
Explorer

Upgrading to Splunk 5.0.3 resolves the problem as it returns an empty array for results:

"results":[]

The ResultReaderJson then can correctly parse it.

View solution in original post

0 Karma

andras_kerekes
Explorer

Upgrading to Splunk 5.0.3 resolves the problem as it returns an empty array for results:

"results":[]

The ResultReaderJson then can correctly parse it.

View solution in original post

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!