I believe I found a logic flaw in the All Incidents dashboard in the Palo Alto Networks App for Splunk. The flaw seems to affect two panels:
- Endpoint Incidents Per Hour
- Aperture SaaS Incidents Per Hour
I noticed that those two panels continuously refresh, even though I'm not refreshing the page. These two panels both have condition logic:
<condition match="'job.resultCount' == 0">
<set token="results-3">1</set>
</condition>
<condition match="'job.resultCount' != 0 AND 'results-3' == 1">
<set token="results-3">0</set>
</condition>
The first time the panel is loaded and there are no matching events in the data model, then the 'job.resultCount' == 0 condition matches and results-3 is set to 1. When the panel refreshes, | makeresults creates at least one output row, which means the second condition will always match. So the panel refreshes and the cycle starts over.
Instead of 'job.resultCount' != 0, I think the second condition needs to be 'job.resultCount' > 1. If there are matching no events in the data model then | makeresults will still produce a single output row, but the second condition ('job.resultCount' > 1) will no longer match which stops the repeat cycle. If there IS an event in the datamodel, there will be at least two rows of output, which also stops the cycle.
I think there is a problem here, but I'm not sure if I have it exactly right. It seems to stop the cycle after I changed != to >. What do you think?
