Unable to load the ES content management UI page

[sgopalakrishnan5]

With the latest ESCU build https://repo.splunk.com/artifactory/Solutions/DA/da-ess-contentupdate/builds/develop/latest/DA-ESS-ContentUpdate-3.0.6-7947.spl we are unable to load the ES content management UI page.

This can be reproduced in nightly6, nightly1 etc - https://soln-esnightly6.sv.splunk.com:8000/splunk-es/en-US/app/SplunkEnterpriseSecuritySuite/search?q=search%20index%3D%22_internal%22%20TypeError&display.page.search.mode=smart&dispatch.sample_ratio=1&workload_pool=&earliest=-24h%40h&latest=now&sid=1600716139.2224

This happens after this latest version of ESCU gets installed whereas the previous version works with the content management. Also seeing these errors while trying to load this page -
09-21-2020 12:22:16.524 -0700 ERROR AdminManagerExternal [2453 TcpChannelThread] - Unexpected error "<class 'TypeError'>" from python handler: "the JSON object must be str, bytes or bytearray, not NoneType". See splunkd.log for more details.
09-21-2020 12:22:16.524 -0700 ERROR AdminManagerExternal [2453 TcpChannelThread] - Stack trace from python handler:\nTraceback (most recent call last):\n File "/usr/local/bamboo/splunk-install/current/lib/python3.7/site-packages/splunk/admin.py", line 114, in init_persistent\n hand.execute(info)\n File "/usr/local/bamboo/splunk-install/current/lib/python3.7/site-packages/splunk/admin.py", line 637, in execute\n if self.requestedAction == ACTION_LIST: self.handleList(confInfo)\n File "/usr/local/bamboo/splunk-install/current/etc/apps/SplunkEnterpriseSecuritySuite/lib/SplunkEnterpriseSecuritySuite/rest_handler.py", line 369, in wrapper\n r = f(self, *args, **kwargs)\n File "/usr/local/bamboo/splunk-install/current/etc/apps/SplunkEnterpriseSecuritySuite/bin/es_investigations_rest_handler.py", line 244, in handleList\n stanza_name, stanza_attributes, klass))\n File "/usr/local/bamboo/splunk-install/current/etc/apps/SplunkEnterpriseSecuritySuite/bin/es_investigations_rest_handler.py", line 527, in get_panels_from_stanza\n panel_list = json.loads(stanza_attributes.get('panels', '[]'))\n File "/usr/local/bamboo/splunk-install/current/lib/python3.7/json/init.py", line 341, in loads\n raise TypeError(f'the JSON object must be str, bytes or bytearray, '\nTypeError: the JSON object must be str, bytes or bytearray, not NoneType\n

This is not seen with older builds - https://repo.splunk.com/artifactory/Solutions/DA/da-ess-contentupdate/builds/develop/7931/

[patel-bhavin]

hey @sgopalakrishnan5 : thanks for raising this issue: i believe I have found the commit which is causing this to fail :

https://github.com/splunk/security-content/blob/4f8b5cd6a962ab82a0c70ecea77b7baa9363468d/bin/jinja2_templates/es_investigations.j2

will do some more testing and come up with a fix

[patel-bhavin]

that said, when i try to repro the error locally: 3.0.6 seems to work just fine. the issue comes up with 3.0.7 which is the latest ESCU release

[patel-bhavin]

created a PR with a fix : #683