Dashboards & Visualizations

Radial gauge not showing in form

stjack99
Explorer

I'm trying to make a form where I can select a host, and then get various kinds of perfmon & wmi info about it. So far, I can get it to dump data into normal line charts, but if I try to get it to dump data into a radial gauge, the gauge doesn't show and the following message is displayed instead: Search did not generate any statistical results.

Here's a screenshot of the form running.

Here's the code of my form.

    <?xml version='1.0' encoding='utf-8'?>
<form>
  <label>Server Performance - Detailed</label>
  <searchTemplate>host="$host$" AND (sourcetype="Perfmon*" OR sourcetype="WMI*") | fields + host, counter, sourcetype, instance, Value</searchTemplate>
  <earliestTime>rt-30m</earliestTime>
  <latestTime>rt</latestTime> 

  <fieldset>
    <input type="radio" token="host">
      <label>Select Host</label>
      <populatingSearch fieldForValue="host" fieldForLabel="host">sourcetype="Perfmon*" OR sourcetype="WMI*" earliest="-60m" latest="now" | dedup host | table host | sort host</populatingSearch>
    </input>
  </fieldset>

  <row>
    <chart>
      <searchPostProcess>where sourcetype="Perfmon:LogicalDisk" AND counter="% Disk Read Time" AND NOT instance="_Total" | stats last(Value) AS lastValue by instance | stats max(lastValue) AS maxValue | gauge maxValue</searchPostProcess>
      <title>test</title>
      <option name="charting.chart">radialGauge</option>
      <option name="charting.chart.style">shiny</option>
    </chart>

    <table>
      <searchPostProcess>search sourcetype="Perfmon:LogicalDisk" counter="% Disk Read Time" NOT instance="_Total" | stats last(Value) AS Value by instance | stats max(Value) AS Value</searchPostProcess>
      <title>test</title>
    </table>
  </row>

  <row>
    <chart>
      <searchPostProcess>search sourcetype="Perfmon:LogicalDisk" counter="% Disk Write Time" NOT instance="_Total" | timechart avg(Value) by instance</searchPostProcess>
      <title>% Disk Write Time</title>
      <option name="chartTitle">% Disk Write Time</option>
      <option name="charting.chart">line</option>
      <option name="charting.chart.nullValueMode">zero</option>
      <option name="charting.legend.placement">top</option>
      <option name="drilldown">none</option>
      <option name="primaryAxisTitle.text">Time</option>
      <option name="secondaryAxisTitle.text">% Write Time</option>
      <option name="charting.scaleX">1</option>
    </chart>

    <chart>
      <searchPostProcess>search sourcetype="Perfmon:LogicalDisk" counter="% Disk Read Time" NOT instance="_Total" | timechart avg(Value) by instance</searchPostProcess>
      <title>% Disk Read Time</title>
      <option name="chartTitle">% Disk Read Time</option>
      <option name="charting.chart">line</option>
      <option name="charting.chart.nullValueMode">zero</option>
      <option name="charting.legend.placement">top</option>
      <option name="drilldown">none</option>
      <option name="primaryAxisTitle.text">Time</option>
      <option name="secondaryAxisTitle.text">% Read Time</option>
      <option name="charting.scaleX">1</option>
    </chart>
  </row>
</form>
Tags (2)
0 Karma
1 Solution

stjack99
Explorer

I finally figured it out. I forgot to add the following line to the chart:
1

Add that, remove the gauge part at the end, and it works.

<chart>
  <searchPostProcess>search sourcetype="Perfmon:LogicalDisk" AND counter="% Disk Read Time" AND NOT instance="_Total" | stats last(Value) AS lastValue by instance | stats max(lastValue) AS maxValue</searchPostProcess>
  <title>test</title>
  <option name="charting.chart">radialGauge</option>
  <option name="charting.chart.style">shiny</option>
  <option name="charting.scaleX">1</option>
</chart>

View solution in original post

0 Karma

stjack99
Explorer

I finally figured it out. I forgot to add the following line to the chart:
1

Add that, remove the gauge part at the end, and it works.

<chart>
  <searchPostProcess>search sourcetype="Perfmon:LogicalDisk" AND counter="% Disk Read Time" AND NOT instance="_Total" | stats last(Value) AS lastValue by instance | stats max(lastValue) AS maxValue</searchPostProcess>
  <title>test</title>
  <option name="charting.chart">radialGauge</option>
  <option name="charting.chart.style">shiny</option>
  <option name="charting.scaleX">1</option>
</chart>
0 Karma

Simon_Fishel
Splunk Employee
Splunk Employee

This configuration should now work with the JSChart module in 4.3.1

0 Karma

Simon_Fishel
Splunk Employee
Splunk Employee

Oh I see, I was thrown off by the fact that the line charts worked and the gauge didn't, but it's because you had forced them to use the Flash renderer. There is a bug with post-processing in the new non-Flash charting module.

If you're ok with Flash charts, you're all set. But you can also work around this in some cases by modifying the base search. See this post:

http://splunk-base.splunk.com/answers/38685/jschart-search-postprocess-search-did-not-generate-any-s...

0 Karma

Simon_Fishel
Splunk Employee
Splunk Employee

It could be the 'where' command in your post-process that is causing the problem. You might try starting the post-process for the gauge in the same way as the other charts ("search sourcetype=...").

0 Karma

stjack99
Explorer

I actually had that originally. I tried a bunch of different search queries to no avail.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...