Improve error handling

[pvanisacker]

I ran into the following error when trying to parse restults:

.../.rvm/gems/ruby-1.9.3-p362@Forking_Monitoring/gems/splunk-sdk-ruby-1.0.0/lib/splunk-sdk-ruby/resultsreader.rb:189:in `resume': dead fiber called (FiberError)
    from /var/go/.rvm/gems/ruby-1.9.3-p362@Forking_Monitoring/gems/splunk-sdk-ruby-1.0.0/lib/splunk-sdk-ruby/resultsreader.rb:189:in `initialize'
    from ./run.rb:117:in `new'
    from ./run.rb:117:in `<main>'

The underlying error was because of the following response being received:

<response><messages><msg type='FATAL'>Invalid value &quot;&apos;-15m@m&apos;&quot; for time term &apos;earliest&apos;</msg></messages></response>

It would be nice if the Ruby SDK handles error in a nicer way. Because a 'dead fiber called' error is something completly different that receiving an error response from Splunk

[madhadron]

Thanks for reporting that. It's supposed to throw an exception before it gets to the ResultsReader when there's an error like that. Apparently it's not...

I'll also add a todo to my list to add better error messages when the input to ResultsReader is malformed. I agree that dead fiber is not a good message.

[jdeerin1]

I ran into this same issue. The underlying cause was a repeated group-by field.

[fornellas]

I am also suffering with this cryptic bug. I am trying to do delete all events from an index (in a Cucumber test):

  response = @splunk.create_oneshot(
    "search index=#{splunk_index} | delete",
  )
  results =  Splunk::ResultsReader.new(response)
  results.each do |result|
     pp result
  end

and I am also getting:

      dead fiber called (FiberError)
      /home/fornellas/src/splunk-sdk-ruby/lib/splunk-sdk-ruby/resultsreader.rb:189:in `resume'
      /home/fornellas/src/splunk-sdk-ruby/lib/splunk-sdk-ruby/resultsreader.rb:189:in `initialize'

The Fiber started at https://github.com/splunk/splunk-sdk-ruby/blob/master/lib/splunk-sdk-ruby/resultsreader.rb#L179 exits before resume is called at https://github.com/splunk/splunk-sdk-ruby/blob/master/lib/splunk-sdk-ruby/resultsreader.rb#L189. This happens because in my case, there is no result, just the message.

In this particular case, in my understanding, Splunk Server itself should have returned HTTP 403 (http://docs.splunk.com/Documentation/Splunk/6.3.0/RESTUM/RESTusing, "HTTP Status Codes"), and is where the root cause is.

For what is worth for this library, the second best thing, could be to raise exceptions in case the response has error or fatal messages (inside ResultsListener).

This though, would not solve the general case, where the XML does not come exactly as expected by the code. As stated at http://docs.splunk.com/Documentation/Splunk/6.3.0/RESTUM/RESTusing "Response elements", "...Some endpoints override the default sort order.". So, still, other stuff can cryptically break, or worse, errors silently ignored.

[fornellas]

Made a minimal fix: https://github.com/splunk/splunk-sdk-ruby/pull/44