Splunk Dev

Java JDK - ResultsReaderCsv throws java.lang.ArrayIndexOutOfBoundsException: 3

fredthefrog
Explorer

Windows 10 64-bit
JavaSE 1.8.0_192
splunk-sdk-java-1.6.5.jar
opencsv-2.3.jar

Only for certain dates/data does this seem to occur, very frustrating.
Does not appear to be a data volume issue, larger row counts can be successfully extracted.
Leads me to believe it's data-dependent, but cannot determine the cause.
Investigating data via splunk web GUI was inconclusive.

while ((event = resultsReader.getNextEvent()) != null)

throws java.lang.ArrayIndexOutOfBoundsException: 3

Does the "3" value provide any insight?
Detailed exception data attached as graphic image.
alt text

Labels (1)
0 Karma

fredthefrog
Explorer

This is an explanation of the root cause, and not an answer/solution as such. Upon ingesting over thirty different log files, Splunk has aggregated eight data lines from three different log files into a single result. ResultsReaderCSV is barfing when it runs past the end of the first line of the multi-line string value.

To validate the log file ingestion, I asked our Splunk admins to double-check their configuration for the specific attributes of this file, and they said they were as expected, and correct. I'm guessing the original log file on that date had corrupted line endings on the first line of the event group, and that was throwing off the OpenCSV code that fetches the next line.

0 Karma

fredthefrog
Explorer

Finally got the stack trace I've been needing.
Retrieving results page 8
java.lang.ArrayIndexOutOfBoundsException: 3
at com.splunk.ResultsReaderCsv.getNextEventInCurrentSet(ResultsReaderCsv.java:109)
at com.splunk.ResultsReader.getNextElement(ResultsReader.java:87)
at com.splunk.ResultsReader.getNextEvent(ResultsReader.java:64)
at SplunkQuery.parseSplunkResults(SplunkQuery.java:479)
at SplunkQuery.main(SplunkQuery.java:194)

0 Karma

fredthefrog
Explorer

Additional server info:
Splunk>enterprise 7.3.2
Version:7.3.2
Build: c60db69f8e32

0 Karma

fredthefrog
Explorer

I'm quickly determining the cause may not be the SDK or the ResultsReaderCsv, but my Java code. When I find it, I will post the resolution. Thank you for reading.

0 Karma

fredthefrog
Explorer

I'm reducing the Java code to the absolute bare minimum to determine if the problem persists. If it does, then it's definitely the Java SDK. Meanwhile, can anyone provide a reliable Java example of paging through >200K events/results?

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

 Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What's New in Splunk Observability - August 2025

What's New We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what is ...

Introduction to Splunk AI

How are you using AI in Splunk? Whether you see AI as a threat or opportunity, AI is here to stay. Lucky for ...