Dashboards & Visualizations

Encountered an unexpected error while parsing intentions

jangid
Builder

I created a Dashboard from following search

sourcetype="TAFC_LOG_LINE" MANAGER | table _time _raw TransactionUUID | rename TransactionUUID as UUID | streamstats range(_time) as Duration by UUID | where Duration > 0.0

Now in Dashboard there is two option
UUID
Duration

When I click on duration I got above error with below message

PARSER: Applying intentions failed Unable to drilldown because of post-reporting 'streamstats' command

Here is the XML for Dashboard
<?xml version='1.0' encoding='utf-8'?>




UUID
UUID
line


Tags (2)
1 Solution

jangid
Builder

I modified my query and now its work.

View solution in original post

0 Karma

jangid
Builder

I modified my query and now its work.

0 Karma

jangid
Builder

is there any solution available for this ?

0 Karma

Ayn
Legend

Just putting this as a comment because it's not really an answer, but I suspect your problems might have something common with this: http://splunk-base.splunk.com/answers/6076/parser-error-on-drilldown-when-using-table

0 Karma

jangid
Builder

Any update regarding my question?

0 Karma
Get Updates on the Splunk Community!

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer at Splunk .conf24 ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...

Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...

Combine Multiline Logs into a Single Event with SOCK: a Step-by-Step Guide for ...

Combine multiline logs into a single event with SOCK - a step-by-step guide for newbies Olga Malita The ...