All Apps and Add-ons

JSChart Search PostProcess: Search did not generate any statistical results.

bojank
New Member

Hello,

I'm trying to move new apps on Splunk 4.3 to JSChart however I have problems with the following error when using PostProcess search: Search did not generate any statistical results.

If I click few times on link switcher the search will appear.

Anyone found any solution?




splunk.search.job
True
1
warn

<module name="StaticContentSample" layoutPanel="viewHeader">
    <param name="text">&lt;/p&gt;&lt;ul&gt;&lt;li&gt;&lt;strong&gt;&lt;a href="https://ocx/en-US/app/noss/fw_conn_formsearch"&gt;Firewall Connections Detail Form Search</param>
</module>

<module name="Search" layoutPanel="panel_row1_col1_grp2" autoRun="True">
    <param name="search">eventtype="firewall_conn_count" | dedup error_code | rangemap field=active_conn low=0-1000 elevated=1001-2000 default=severe</param>
    <param name="earliest">-1h</param>
    <module name="SingleValue">
        <param name="field">active_conn</param>
        <param name="classField">range</param>
        <param name="beforeLabel">Active Connections:</param>
    </module>
</module>
<module name="Search" layoutPanel="panel_row1_col1_grp3" autoRun="True">
    <param name="search">eventtype="firewall_conn_count" | dedup error_code | rangemap field=max_conn low=0-5000 elevated=5001-9000 default=severe</param>
    <param name="earliest">-1h</param>
    <module name="SingleValue">
        <param name="field">max_conn</param>
        <param name="classField">range</param>
        <param name="beforeLabel">Max Connections:</param>
    </module>
</module>

<module name="TimeRangePicker" layoutPanel="panel_row1_col1_grp1"><!-- Start TimeRangePicker -->
    <param name="searchWhenChanged">True</param>
    <param name="default">Today</param>

    <module name="Search" layoutPanel="panel_row2_col1" autoRun="True"><!-- Start Connection Timeline  Search -->
        <param name="search">index="firewall_summary" stype="firewall_conn" | timechart span=1m sum(Built) as Built sum(Teardown) as Teardown</param>
        <module name="JobProgressIndicator"/>
        <module name="HiddenChartFormatter">
            <param name="charting.legend.placement">bottom</param>
            <param name="charting.primaryAxisTitle.text">Event Count</param>
            <param name="charting.secondaryAxisTitle.text">Time</param>
            <param name="charting.chart">line</param>
            <param name="charting.fieldColors">{"Teardown":0xE51B1A,"Built":0x6C943B}</param>
            <module name="JSChart">
                <module name="Gimp"/>
                <param name="width">100%</param>
                <param name="height">250px</param>
            </module>
        </module>
    </module><!-- End Connection Timeline  Search -->

    <module name="Search" layoutPanel="panel_row3_col1" autoRun="True"><!-- Start Connection Charts  Search -->
        <param name="search">eventtype="firewall_build_conn" conn_src_int="*" conn_src_host_local="*" conn_src_port_local="*" conn_src_host_global="*" conn_src_port_global="*" conn_dest_int="*" conn_dest_host_local="*" conn_dest_port_local="*" conn_dest_host_global="*" conn_dest_port_global="*" conn_id="*" conn_protocol="*" conn_type="*"</param>
        <module name="LinkSwitcher" group="IP Address Details" layoutPanel="panel_row3_col1"><!-- Start IP Address Details Link Switcher -->
            <param name="mode">independent</param>
            <param name="label">Use the links bellow to switch between charts</param>
            <module name="PostProcess" group="by Local Source IP" autoRun="True">
                <param name="search">| stats count by conn_src_host_local | head 20</param>
                <module name="HiddenChartFormatter">
                    <param name="charting.legend.placement">none</param>
                    <param name="charting.chart">pie</param>
                    <module name="JSChart">
                <module name="Gimp"/>

                        <param name="width">100%</param>
                        <param name="height">250px</param>
                    </module>
                </module>
            </module>
            <module name="PostProcess" group="by Local Destination IP" autoRun="False">
                <param name="search">| stats count by conn_dest_host_local | head 20</param>
                <module name="HiddenChartFormatter">
                    <param name="charting.legend.placement">none</param>
                    <param name="charting.chart">pie</param>
                    <module name="JSChart">
                <module name="Gimp"/>

                        <param name="width">100%</param>
                        <param name="height">250px</param>
                    </module>
                </module>
            </module>
            <module name="PostProcess" group="by Global Source IP" autoRun="False">
                <param name="search">| stats count by conn_src_host_global | head 20</param>
                <module name="HiddenChartFormatter">
                    <param name="charting.legend.placement">none</param>
                    <param name="charting.chart">pie</param>
                    <module name="JSChart">
                <module name="Gimp"/>

                        <param name="width">100%</param>
                        <param name="height">250px</param>
                    </module>
                </module>
            </module>
            <module name="PostProcess" group="by Global Destination IP" autoRun="False">
                <param name="search">| stats count by conn_dest_host_global | head 20</param>
                <module name="HiddenChartFormatter">
                    <param name="charting.legend.placement">none</param>
                    <param name="charting.chart">pie</param>
                    <module name="JSChart">
                <module name="Gimp"/>

                        <param name="width">100%</param>
                        <param name="height">250px</param>
                    </module>
                </module>
            </module>
        </module><!-- End IP Address Details Link Switcher -->
0 Karma

Simon_Fishel
Splunk Employee
Splunk Employee

It looks like this might be due to a bug in the JSChart module when a post-process is being performed on a non-reporting search. Take a look at this post for a couple of work-around options.

Simon_Fishel
Splunk Employee
Splunk Employee

This configuration should now work with the JSChart module in 4.3.1

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...