splunk / splunk/splunk-sdk-python

Empty accelerated fields leads to TypeError

Open
#677 0 comments 0 reactions 1 assignee View on GitHub

@Ickerday is already working on this.

Since Nov 13, 2025.

bug KV Store
Dominant language
Python
Stars
743
Forks
387
Avg merge
42m
Merged PRs (30d)
4

Description

Describe the bug

def __getitem__(self, item):
        res = Collection.__getitem__(self, item)
        for k, v in res.content.items():
            if "accelerated_fields" in k:
                res.content[k] = json.loads(v)
        return res

This code breaks if v is not a valid JSON string.
As there is no way to remove an acceleration other than setting it to empty, this is a typical case.

To Reproduce
Steps to reproduce the behaviour:

c.kvstore.create("test")
collection = c.kvstore["test"]
collection.update_accelerated_field("test", {"test": 1})
collection = c.kvstore["test"]
collection.update_accelerated_field("test", "")
collection = c.kvstore["test"]

Expected behaviour
Rather than an exception, the empty string is used as the value.

If I am allowed to dream, splunkd should provide a mechanism to remove accelerations and field configurations cleanly. However, this bug should still be fixed, as we never know what administrators might write in .conf files.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.