Splunk Dev

Infinite loop when there are no results using JSON output

andras_kerekes
Explorer

I am using Splunk 5.0.2 with Java SDK 1.1. If I run a search that does not return any result, and use the ResultReaderJson class to parse the result the com.splunk.ResultsReaderJson#readEvent method gets into an infinite loop and does not return.

The problem is that when Splunk tries to parse the following:

{"results":[{"count":0}]}

It starts reading the object starting at the {, it reads the count as name (in /com/splunk/ResultsReaderJson.java:287) then the next Json token is a JsonToken.NUMBER with the value 0, but the method does not handle it, it expects only *_START/ *_END, NAME and STRING tokens.

1 Solution

andras_kerekes
Explorer

Upgrading to Splunk 5.0.3 resolves the problem as it returns an empty array for results:

"results":[]

The ResultReaderJson then can correctly parse it.

View solution in original post

0 Karma

andras_kerekes
Explorer

Upgrading to Splunk 5.0.3 resolves the problem as it returns an empty array for results:

"results":[]

The ResultReaderJson then can correctly parse it.

0 Karma
Get Updates on the Splunk Community!

New Year, New Changes for Splunk Certifications

As we embrace a new year, we’re making a small but important update to the Splunk Certification ...

[Puzzles] Solve, Learn, Repeat: Unmerging HTML Tables

[Puzzles] Solve, Learn, Repeat: Unmerging HTML TablesFor a previous puzzle, I needed some sample data, and ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...