Splunk Search

splunk 4.3 - searchPostProcess on chart component not working

chusi
New Member

After upgrading to 4.3 our custom forms with a chart component started to show up the following error:

Search did not generate any statistical results. 

The table and event component still works with the searchPostProcess statement as expected, only the chart fails.

The following is some example code which fails in splunk 4.3 but worked before.

<form>
  <searchTemplate>index=*</searchTemplate>
  <label>Test PostProcess</label>
  <fieldset>
    <input type="time" />
  </fieldset>

 <row>
  <chart>
      <title>Test Chart</title>
      <searchPostProcess>timechart count</searchPostProcess>
      <option name="charting.chart">column</option>
  </chart>
</row>
</form>

If i do the the same search directly in the chart component, it works as expected...

<form>
  <!--<searchTemplate>index=*</searchTemplate>-->
  <label>Test PostProcess</label>
  <fieldset>
      <input type="time" />
  </fieldset>

    <row>
      <chart>
          <title>Test Chart</title>
          <searchTemplate>index=* | timechart count</searchTemplate>
          <option name="charting.chart">column</option>
      </chart>

  </row>
  </form>     

somebody having the same problem? or even know a solution?

0 Karma
1 Solution

rruijgrok
Explorer

Had the same problem.
The fix described in this post link text

worked for me.
Just add <option name="charting.scaleX">1</option> to the chart.

Also found that not all fields were available for searchPostProcess (the fields extracted at search time)
Fixed that by adding '| field + *' in the searchTemplate.

View solution in original post

rruijgrok
Explorer

The above answer by Simon only works if the view is displaying graphs only and each event contains the same fields.
My view displays graphs, tables and events based upon 1 base search and events do not necessarily have the same fields.

Also I do not want aggregation or statistics in the base search, as it kills the event display.

0 Karma

Simon_Fishel
Splunk Employee
Splunk Employee

This is a bug in the new non-Flash charting module. It crops up when the base search of a post-process operation is not itself a reporting search. We're tracking the issue and it will likely be fixed soon.

In the meantime, if you don't want to switch the chart to Flash, you can also work around it by making the base search a reporting search (which is recommended practice anyway). Check out the docs for a full explanation, the gist is that you'll need to add a reporting command in the base search that includes all of the fields that are being used downstream.

Simon_Fishel
Splunk Employee
Splunk Employee

This configuration should now work with the JSChart module in 4.3.1

rruijgrok
Explorer

Had the same problem.
The fix described in this post link text

worked for me.
Just add <option name="charting.scaleX">1</option> to the chart.

Also found that not all fields were available for searchPostProcess (the fields extracted at search time)
Fixed that by adding '| field + *' in the searchTemplate.

swdonline
Path Finder

Disregard. I had to change "splitSeries" to false. Worked great. Thanks!

0 Karma

swdonline
Path Finder

That got the chart showing again, but with sparklines. It's no longer honoring stackmode: "stacked"

0 Karma

chusi
New Member

great! that totally fixed it! thank you very much!

0 Karma

swdonline
Path Finder

Same problem here...

   <form>

   <label>Class Miner v2.0</label>

    <searchTemplate>index="*" | fillnull value=NULL | search $name$ $class$ $grade$</searchTemplate>

    <fieldset>

        <input type="dropdown" token="name">
            <populatingSearch fieldForValue="name" fieldForLabel="name"><![CDATA[index="summary_names" | fields
 name | dedup name | sort name ]]></populatingSearch>
            <prefix>name="</prefix>
            <suffix>"</suffix>
            <choice value="*">Any</choice>
            <default>Any</default>
        </input>

        <input type="dropdown" token="class">
            <prefix>class="</prefix>
            <suffix>"</suffix>
            <choice value="*">Any</choice>
            <choice value="CS">CompSci</choice>
            <choice value="EN">English</choice>
            <choice value="HI">History</choice>
            <choice value="MA">Math</choice>
            <default>Any</default>
        </input>

        <input type="dropdown" token="grade">
            <populatingSearch fieldForValue="grade" fieldForLabel="grade"><![CDATA[index="summary_grades" | fields grade | dedup grade | sort grade]]></populatingSearch>
            <prefix>grade="</prefix>
            <suffix>"</suffix>
            <choice value="*">Any</choice>
            <default>Any</default>
        </input>
    </fieldset>
    <row>
        <chart>
            <title>Grades By Class</title>
            <searchPostProcess>search class!="Unknown"| timechart count by class</searchPostProcess> 
            <option name="charting.chart">area</option>
            <option name="charting.legend.placement">right</option>
            <option name="charting.chart.stackMode">stacked</option>
            <option name="charting.layout.splitSeries">True</option>
        </chart>
   </row>
</form>
0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...