Splunk Dev

Infinite loop when there are no results using JSON output

andras_kerekes
Explorer

I am using Splunk 5.0.2 with Java SDK 1.1. If I run a search that does not return any result, and use the ResultReaderJson class to parse the result the com.splunk.ResultsReaderJson#readEvent method gets into an infinite loop and does not return.

The problem is that when Splunk tries to parse the following:

{"results":[{"count":0}]}

It starts reading the object starting at the {, it reads the count as name (in /com/splunk/ResultsReaderJson.java:287) then the next Json token is a JsonToken.NUMBER with the value 0, but the method does not handle it, it expects only *_START/ *_END, NAME and STRING tokens.

1 Solution

andras_kerekes
Explorer

Upgrading to Splunk 5.0.3 resolves the problem as it returns an empty array for results:

"results":[]

The ResultReaderJson then can correctly parse it.

View solution in original post

0 Karma

andras_kerekes
Explorer

Upgrading to Splunk 5.0.3 resolves the problem as it returns an empty array for results:

"results":[]

The ResultReaderJson then can correctly parse it.

0 Karma
Get Updates on the Splunk Community!

Splunk MCP & Agentic AI: Machine Data Without Limits

  Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization ...

Finding Based Detections General Availability

Overview  We’ve come a long way, folks, but here in Enterprise Security 8.4 I’m happy to announce Finding ...

Get Your Hands Dirty (and Your Shoes Comfy): The Splunk Experience

Hands-On Learning and Technical Seminars  Sometimes, you just need to see the code. For those looking for a ...