Dashboards & Visualizations

Radial gauge not showing in form

stjack99
Explorer

I'm trying to make a form where I can select a host, and then get various kinds of perfmon & wmi info about it. So far, I can get it to dump data into normal line charts, but if I try to get it to dump data into a radial gauge, the gauge doesn't show and the following message is displayed instead: Search did not generate any statistical results.

Here's a screenshot of the form running.

Here's the code of my form.

    <?xml version='1.0' encoding='utf-8'?>
<form>
  <label>Server Performance - Detailed</label>
  <searchTemplate>host="$host$" AND (sourcetype="Perfmon*" OR sourcetype="WMI*") | fields + host, counter, sourcetype, instance, Value</searchTemplate>
  <earliestTime>rt-30m</earliestTime>
  <latestTime>rt</latestTime> 

  <fieldset>
    <input type="radio" token="host">
      <label>Select Host</label>
      <populatingSearch fieldForValue="host" fieldForLabel="host">sourcetype="Perfmon*" OR sourcetype="WMI*" earliest="-60m" latest="now" | dedup host | table host | sort host</populatingSearch>
    </input>
  </fieldset>

  <row>
    <chart>
      <searchPostProcess>where sourcetype="Perfmon:LogicalDisk" AND counter="% Disk Read Time" AND NOT instance="_Total" | stats last(Value) AS lastValue by instance | stats max(lastValue) AS maxValue | gauge maxValue</searchPostProcess>
      <title>test</title>
      <option name="charting.chart">radialGauge</option>
      <option name="charting.chart.style">shiny</option>
    </chart>

    <table>
      <searchPostProcess>search sourcetype="Perfmon:LogicalDisk" counter="% Disk Read Time" NOT instance="_Total" | stats last(Value) AS Value by instance | stats max(Value) AS Value</searchPostProcess>
      <title>test</title>
    </table>
  </row>

  <row>
    <chart>
      <searchPostProcess>search sourcetype="Perfmon:LogicalDisk" counter="% Disk Write Time" NOT instance="_Total" | timechart avg(Value) by instance</searchPostProcess>
      <title>% Disk Write Time</title>
      <option name="chartTitle">% Disk Write Time</option>
      <option name="charting.chart">line</option>
      <option name="charting.chart.nullValueMode">zero</option>
      <option name="charting.legend.placement">top</option>
      <option name="drilldown">none</option>
      <option name="primaryAxisTitle.text">Time</option>
      <option name="secondaryAxisTitle.text">% Write Time</option>
      <option name="charting.scaleX">1</option>
    </chart>

    <chart>
      <searchPostProcess>search sourcetype="Perfmon:LogicalDisk" counter="% Disk Read Time" NOT instance="_Total" | timechart avg(Value) by instance</searchPostProcess>
      <title>% Disk Read Time</title>
      <option name="chartTitle">% Disk Read Time</option>
      <option name="charting.chart">line</option>
      <option name="charting.chart.nullValueMode">zero</option>
      <option name="charting.legend.placement">top</option>
      <option name="drilldown">none</option>
      <option name="primaryAxisTitle.text">Time</option>
      <option name="secondaryAxisTitle.text">% Read Time</option>
      <option name="charting.scaleX">1</option>
    </chart>
  </row>
</form>
Tags (2)
0 Karma
1 Solution

stjack99
Explorer

I finally figured it out. I forgot to add the following line to the chart:
1

Add that, remove the gauge part at the end, and it works.

<chart>
  <searchPostProcess>search sourcetype="Perfmon:LogicalDisk" AND counter="% Disk Read Time" AND NOT instance="_Total" | stats last(Value) AS lastValue by instance | stats max(lastValue) AS maxValue</searchPostProcess>
  <title>test</title>
  <option name="charting.chart">radialGauge</option>
  <option name="charting.chart.style">shiny</option>
  <option name="charting.scaleX">1</option>
</chart>

View solution in original post

0 Karma

stjack99
Explorer

I finally figured it out. I forgot to add the following line to the chart:
1

Add that, remove the gauge part at the end, and it works.

<chart>
  <searchPostProcess>search sourcetype="Perfmon:LogicalDisk" AND counter="% Disk Read Time" AND NOT instance="_Total" | stats last(Value) AS lastValue by instance | stats max(lastValue) AS maxValue</searchPostProcess>
  <title>test</title>
  <option name="charting.chart">radialGauge</option>
  <option name="charting.chart.style">shiny</option>
  <option name="charting.scaleX">1</option>
</chart>
0 Karma

Simon_Fishel
Splunk Employee
Splunk Employee

This configuration should now work with the JSChart module in 4.3.1

0 Karma

Simon_Fishel
Splunk Employee
Splunk Employee

Oh I see, I was thrown off by the fact that the line charts worked and the gauge didn't, but it's because you had forced them to use the Flash renderer. There is a bug with post-processing in the new non-Flash charting module.

If you're ok with Flash charts, you're all set. But you can also work around this in some cases by modifying the base search. See this post:

http://splunk-base.splunk.com/answers/38685/jschart-search-postprocess-search-did-not-generate-any-s...

0 Karma

Simon_Fishel
Splunk Employee
Splunk Employee

It could be the 'where' command in your post-process that is causing the problem. You might try starting the post-process for the gauge in the same way as the other charts ("search sourcetype=...").

0 Karma

stjack99
Explorer

I actually had that originally. I tried a bunch of different search queries to no avail.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...