[SimpleResultsTable module] (9, 'Bad file descriptor')

[srw46]

Hi guys,

Does anybody have any information on the above error? It seems to be rampant in my dashboards and preloaded searches. It's fairly benign and more of an irritation than anything but I'm polishing now and would like to get rid of it.

It tends to appear and then will often go away again as the results come in. Sometimes it won't go away unless you run the search again or hit F5.

Many thanks for your suggestions

[bmgilmore]

I actually get it when in the regular flashtimeline search app:

[SimpleResultsTable module] [Errno 9] Bad file descriptor

It pops up, sometimes goes away on its own, but if I use the paginator or refresh it goes away for a little bit.

[srw46]

Still a mystery then? I know I'm not the only person to get this but I also know that some have never seen it either so it suggests it's avoidable or has a definite cause.

I'm going to submit something to support about this once I've been able to capture a screenshot. In the meantime I pulled something from web_service.log:

2012-02-22 08:11:04,901 ERROR [4f44a318c63e76ba8] module:56 - [Errno 9] Bad file descriptor
Traceback (most recent call last):

File "D:\Program Files\Splunk\Python-2.6\Lib\site-packages\splunk\appserver\mrsparkle\controllers\module.py", line 54, in renderModule
pageContent = instance.generateResults(**args)

File "D:\Program Files\Splunk\share\splunk\search_mrsparkle\modules\results\SimpleResultsTable.py", line 140, in generateResults
adjustedMin, adjustedMax = util.getPercentiles(ordered, .05, .95)

File "D:\Program Files\Splunk\Python-2.6\Lib\site-packages\splunk\appserver\mrsparkle\lib\util.py", line 542, in getPercentiles
return (v(lowerPercentile, orderedList), v(upperPercentile, orderedList))

File "D:\Program Files\Splunk\Python-2.6\Lib\site-packages\splunk\appserver\mrsparkle\lib\util.py", line 534, in v
n, k, d = f(percentile, len(oList))

File "D:\Program Files\Splunk\Python-2.6\Lib\site-packages\splunk\appserver\mrsparkle\lib\util.py", line 530, in f
print n,k,d

IOError: [Errno 9] Bad file descriptor

[srw46]

Yes they are custom dashboards, 4.2.3 at the moment (upgrade pending) and they are directly edited XML.

I'm just after any clues on what the message is saying so I can track the problem down.

[Drainy]

Are these on your own custom dashboards? if not specifically which dashboards are they? What version of Splunk are you running and if they are custom dashboards have you created them by editing the XML directly or through the editor?