Chart not plotting in dashboard

[RNB]

I am using Splunk 4.2.1, build 98164. I am creating simple multi-panel dashboards and not all charts in the dashboard are being plotted. For example, one dashboard uses two graphs and one event_viewer. The graph that does not plot uses the same saved search as the event_viewer panel, and of course there is lots of data returned in the event_viewer panel. Therefore, there should be lots of data points for the graph to plot.

This is not the only dashboard I am experiencing this issue with, and clicking on "View results" displays search results that should be plotted. I am also observing that some panels plot data intermittently, where sometimes I will see plotted graphs for a while, and then for a majority of the time, the graph will be blank, not plotted when there are search results that should be plotted.

I am experiencing this issue in both InterNet Explorer 9 and Firefox 3.6.16. Any ideas?

<?xml version='1.0' encoding='utf-8'?>

Ticket 39219


Ticket 39219



Dashboard - Drop Rate Exceeded

all




Ticket 39219

Additional information:

I have moved the charts so they are no longer side by side, one is on top of the other. The chart that is not displaying results actually plots and you can see the results for a fraction of a second before the chart becomes becomes blank. The second chart continues to display the plotted data.

Search strings after the colon:

Ticket 39219: (192.168.153.59 NOT (search))

Dashboard - Drop Rate Exceeded: ( "drop rate" NOT ("search"))

Nick put me on to something:

For the chart panel, I replaced the saved search to an inline search that used the string:

(192.168.153.59 NOT (search)) | timechart count

This is producing a plotted chart consistently so far. Now the other chart is not plotting, but I will use the same method.

[giovere]

If charting.nullValueMode does not work for you try:

<option name="charting.chart.nullValueMode">value...</option>

[Paolo_Prigione · Accepted solution]

Hi RNB,
some things I've noticed:

1. Any Splunk chart expects data in a specific format, which is specified in the Charting Reference page. A <chart> panel won't generally plot a list of events, as nick noted. You should have a command such as stats or timechart to prepare data for plotting. Maybe this is the reason why you don't get any chart.

2. In case you have missing data points and you are using line or area charts, splunk will not show you those points in a line chart. You've got to tell it how to deal with those gaps, which is the following option: <option name="charting.nullValueMode">(accepted values: gaps, zero, and connect)</option>, to be put between the <chart> and </chart> tags.

3. If possible, add markes to line charts in oder to visualize data points which are not connected to anything else: <option name="charting.showMarkers
   ">true</option>

As a personal suggestion, try to manually run your saved search and see whether, on the rightmost part of the screen over the list of returned events/results, you have a "show report" or "build report" button:

• the former means your data can aleady be plotted: open the report viewer and play with the settings at wish
• the latter means your data is not yet suitable for charting, so you will need some repoting command (top, stats, timechart,... therefore to post process the search results)

Cheers!
Paolo

[RNB]

I have changed the searches from saved searches to inline searches. This was done to test the modified searches without modifying the saved searches. I have added "| timechart count" to the inline search strings and I am getting the desired results consistently.

[sideview]

Can you post the actual search language of the "Ticket 39219" search as well? In general searches that return events and do not have another command in them like 'stats' or 'timechart' are not directly chartable in the Flash Chart.

[RNB]

<?xml version='1.0' encoding='utf-8'?>

Ticket 39219


Ticket 39219



Dashboard - Drop Rate Exceeded

all




Ticket 39219

The panel "Ticket 39219" is the panel that is most often blank.

[RicoSuave]

Can you please post the xml for your dashboard? i ran into similar issues with 4.2 and found a bug where single value modules won't render when combined in the same panel as another chart.