search

scalyr / dataset-addon-for-splunk

The DataSet Add-on for Splunk provides integration with
Apache License 2.0
4 stars 6 forks source link

Improve error handling when submitting invalid queries #19

Closed obpedro closed 1 year ago

obpedro commented 1 year ago

Hi team,

First of all, I want to say I love the TA. I just started working with it today and so far it's been amazing, and I look forward to doing some cool stuff with it.

One thing I wanted to open an issue for is that I've been getting the following error whenever I type an invalid query: local variable 'r_json' referenced before assignment. As an example, I get this error when I type in the first example query in this repo's readme: | dataset method=query search="serverHost = * AND Action = 'allow'" maxcount=50 starttime=10m endtime=1m

Another error I've received is 'NoneType' object has no attribute 'steps_completed' This is the query I typed in when I received that error: | dataset maxcount=6 method=query search="logfile=\"/var/log/audit/audit.log\" message=*CRYPTO*" | spath Admittedly the query contains invalid syntax (I later learned to use 'contains') but it would be great to have a more helpful error message.

All that said, maybe these things are due to limitations with what Splunk allows in its SDK and there's nothing that can be done about it, but I still wanted to open the issue just in case.

Thanks! Pedro

weilliu commented 1 year ago

@obpedro Thanks for reporting the issues. I agree that the error message could be more intuitive.

The first error local variable 'r_json' referenced before assignment returns on 0 matching event, and the second error 'NoneType' object has no attribute 'steps_completed' seem to return when the query contains invalid syntax (i.e. message=*CRYPTO* instead of message contains 'CRYPTO' ). You may find the query syntax in the DataSet doc.

I do believe the error message could be improved but need to confirm it with the engineering. If so, we will open a ticket to address it and fix the error message.

Either way, we appreciate your interest and please feel free to report any additional issues encountered!

weilliu commented 1 year ago

I was told by the developer @mike-mcgrail that this was a known regression when the v2 API was pushed. The same issue was reported in #18, so I am going to mark this as a duplicate. Thank you.

mike-mcgrail commented 1 year ago

@obpedro thanks very much for your feedback! Really glad you are seeing value out of it, and we look forward to making this even more powerful for you.

As mentioned, there was recent work to refactor this to use a new set of APIs. Unfortunately, we took a regression on logging and need to tune this. Please feel free to add any comments to issue #18 if I missed anything there.

mike-mcgrail commented 1 year ago

Closing as duplicate of Issue #18