Splunk Dev

Infinite loop when there are no results using JSON output

andras_kerekes
Explorer

I am using Splunk 5.0.2 with Java SDK 1.1. If I run a search that does not return any result, and use the ResultReaderJson class to parse the result the com.splunk.ResultsReaderJson#readEvent method gets into an infinite loop and does not return.

The problem is that when Splunk tries to parse the following:

{"results":[{"count":0}]}

It starts reading the object starting at the {, it reads the count as name (in /com/splunk/ResultsReaderJson.java:287) then the next Json token is a JsonToken.NUMBER with the value 0, but the method does not handle it, it expects only *_START/ *_END, NAME and STRING tokens.

1 Solution

andras_kerekes
Explorer

Upgrading to Splunk 5.0.3 resolves the problem as it returns an empty array for results:

"results":[]

The ResultReaderJson then can correctly parse it.

View solution in original post

0 Karma

andras_kerekes
Explorer

Upgrading to Splunk 5.0.3 resolves the problem as it returns an empty array for results:

"results":[]

The ResultReaderJson then can correctly parse it.

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...