Splunk Dev

Splunk Java SDK -> com.splunk.ResultsReaderJson -> Is this a Bug in the SDK Version 1.1?

lpolo
Motivator

I have the following function that fails when there is not any results returned from the saved search:

Saved search results:
Stats:
{
"preview": false,
"init_offset": 0,
"messages": [],
"fields": [],
"rows": []
}

  private static void rss_wc_failed_azkaban_jobs(String s,String sid,ResultsReaderJson rr) throws Exception {
    HashMap<String, String> event;
    int total=0,failed=0;
    while ((event = rr.getNextEvent()) != null ) {
      if(total>1000) {
        System.out.println("infinte loop found, quitting");
        break;
      }
      System.out.println("Event: "+event.size()+": "+event.toString());
      total++;
      if(event.get("Last State").equalsIgnoreCase("failed")) {
        failed++;
      }
    }

    String title="Service in normal operation state";

    if(failed>0) {
      title="Service with Performance issues";
    }
    if(failed>=5) {
      title="Service disrupted";
    }


    String desc="Number of jobs with failed state: "+failed;

    writeRSS(s,title,sid,desc);
  }

The function is called as follow:

else if(s.equalsIgnoreCase("rss_wc_failed_azkaban_jobs")){
          rss_wc_failed_azkaban_jobs(s,sid,rr);

This is the java dump the shows the line where it fails in "com.splunk.ResultsReaderJson"

2013-04-25 07:39:03
Full thread dump OpenJDK 64-Bit Server VM (19.0-b09 mixed mode):

"Low Memory Detector" daemon prio=10 tid=0x00007fae0009d800 nid=0x7032 runnable [0x0000000000000000]
   java.lang.Thread.State: RUNNABLE

"CompilerThread1" daemon prio=10 tid=0x00007fae0009b000 nid=0x7031 waiting on condition [0x0000000000000000]
   java.lang.Thread.State: RUNNABLE

"CompilerThread0" daemon prio=10 tid=0x00007fae00098000 nid=0x7030 waiting on condition [0x0000000000000000]
   java.lang.Thread.State: RUNNABLE

"Signal Dispatcher" daemon prio=10 tid=0x00007fae00097000 nid=0x702f waiting on condition [0x0000000000000000]
   java.lang.Thread.State: RUNNABLE

"Finalizer" daemon prio=10 tid=0x00007fae00078800 nid=0x702e in Object.wait() [0x00007fadf7af9000]
   java.lang.Thread.State: WAITING (on object monitor)
        at java.lang.Object.wait(Native Method)
        - waiting on <0x000000060cdb7528> (a java.lang.ref.ReferenceQueue$Lock)
        at java.lang.ref.ReferenceQueue.remove(ReferenceQueue.java:133)
        - locked <0x000000060cdb7528> (a java.lang.ref.ReferenceQueue$Lock)
        at java.lang.ref.ReferenceQueue.remove(ReferenceQueue.java:149)
        at java.lang.ref.Finalizer$FinalizerThread.run(Finalizer.java:177)

"Reference Handler" daemon prio=10 tid=0x00007fae00076800 nid=0x702d in Object.wait() [0x00007fadf7bfa000]
   java.lang.Thread.State: WAITING (on object monitor)
        at java.lang.Object.wait(Native Method)
        - waiting on <0x000000060cdb74e8> (a java.lang.ref.Reference$Lock)
        at java.lang.Object.wait(Object.java:502)
        at java.lang.ref.Reference$ReferenceHandler.run(Reference.java:133)
        - locked <0x000000060cdb74e8> (a java.lang.ref.Reference$Lock)

"main" prio=10 tid=0x00007fae00007000 nid=0x7027 runnable [0x00007fae061dd000]
   java.lang.Thread.State: RUNNABLE
        at com.splunk.ResultsReaderJson.readEvent(ResultsReaderJson.java:298)
        at com.splunk.ResultsReaderJson.getNextEventInCurrentSet(ResultsReaderJson.java:235)
        at com.splunk.ResultsReader.getNextElement(ResultsReader.java:89)
        at com.splunk.ResultsReader.getNextEvent(ResultsReader.java:66)
        at Splunk.rss_wc_failed_azkaban_jobs(Splunk.java:624) ->  Code 2
        at Splunk.main(Splunk.java:132) ->  Code 1

"VM Thread" prio=10 tid=0x00007fae0006f800 nid=0x702c runnable

"GC task thread#0 (ParallelGC)" prio=10 tid=0x00007fae00012000 nid=0x7028 runnable

"GC task thread#1 (ParallelGC)" prio=10 tid=0x00007fae00014000 nid=0x7029 runnable

"GC task thread#2 (ParallelGC)" prio=10 tid=0x00007fae00016000 nid=0x702a runnable

"GC task thread#3 (ParallelGC)" prio=10 tid=0x00007fae00017800 nid=0x702b runnable

"VM Periodic Task Thread" prio=10 tid=0x00007fae000a0000 nid=0x7033 waiting on condition

JNI global references: 1279

Heap
 PSYoungGen      total 178240K, used 170434K [0x00000007580b0000, 0x0000000769020000, 0x0000000800000000)
  eden space 102208K, 92% used [0x00000007580b0000,0x000000075dce66e0,0x000000075e480000)
  from space 76032K, 99% used [0x000000075e6c0000,0x00000007630fa470,0x0000000763100000)
  to   space 87872K, 0% used [0x0000000763a50000,0x0000000763a50000,0x0000000769020000)
 PSOldGen        total 343936K, used 81948K [0x0000000608200000, 0x000000061d1e0000, 0x00000007580b0000)
  object space 343936K, 23% used [0x0000000608200000,0x000000060d2071d0,0x000000061d1e0000)
 PSPermGen       total 21248K, used 10124K [0x00000005fdc00000, 0x00000005ff0c0000, 0x0000000608200000)
  object space 21248K, 47% used [0x00000005fdc00000,0x00000005fe5e3268,0x00000005ff0c0000)
Tags (2)

andras_kerekes
Explorer

I am not sure what fails mean in this case, but I experience an infinite loop using JsonResultReader in case there are no results, I use Oracle JDK 6, Splunk SDK 1.1

The problem is that when Splunk tries to parse the following:

{"results":[{"count":0}]}

It starts reading the object starting at the {, it reads the count as name (in /com/splunk/ResultsReaderJson.java:287) then the next Json token is a JsonToken.NUMBER with the value 0, but the method does not handle it, it expects only _START/_END, NAME and STRING tokens.

andras_kerekes
Explorer
0 Karma

Neeraj_Luthra
Splunk Employee
Splunk Employee

@andras_kerekes - What version of Splunk are you running? Would you mind posting a new question with more details of how you are building the results reader object.

0 Karma

Neeraj_Luthra
Splunk Employee
Splunk Employee

Verified that this is an issue specific to OpenJDK. The Splunk Java SDK works fine against Oracle's JDK.

Until this is fixed in the SDK, check the job's resultsCount and build the results reader only if the count is greater than 0.

Get Updates on the Splunk Community!

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...