Subsequent Flash Charts Not Appearing

[matthewcanty]

I have a search with hidden post processes. I have managed to get this working with SingleValues having multiple searches going on, but I can't get beyond one chart with flash charts. The view doesn't fail, it just leaves empty chart space.

<module name="HiddenSearch" layoutPanel="panel_row2_col1_grp1" autoRun="True">
    <param name="search">
        host="*90*" FeedSource="*" | fields _time Fixture FixtureState Selection MarketPrice Action * | sort _time desc
    </param>
    <param name="earliest">rt-1d</param>
    <param name="latest">rt</param>

    <module name="EnablePreview">
        <param name="enable">true</param>
        <param name="display">false</param>  

... ...

<module name="GenericHeader" layoutPanel="panel_row3_col1_grp1" autoRun="True">
            <param name="label">Fixture Caches</param>
            <module name="HiddenPostProcess" layoutPanel="panel_row3_col1_grp1">
                <param name="search">
                    search Fixture>0 | stats max(_time) As LatestTime By Action | eval Gap=time()-LatestTime | chart last(Gap) As "Seconds Since Last Event" By Action
                </param>
                <module name="HiddenChartFormatter">    
                    <param name="chart">column</param>
                    <param name="legend.placement">none</param>
                    <module name="FlashChart">
                        <param name="width">100%</param>
                        <param name="height">100%</param>
                    </module>
                </module>  
            </module>
        </module>
        <module name="GenericHeader" layoutPanel="panel_row3_col1_grp2" autoRun="True">
            <param name="label">Fixture State Caches</param>
            <module name="HiddenPostProcess" layoutPanel="panel_row3_col1_grp2">
                <param name="search">
                    search FixtureState>0 | stats max(_time) As LatestTime By Action | eval Gap=time()-LatestTime | chart last(Gap) As "Seconds Since Last Event" By Action
                </param>
                <module name="HiddenChartFormatter">    
                    <param name="chart">column</param>
                    <param name="legend.placement">none</param>
                    <module name="FlashChart">
                        <param name="width">100%</param>
                        <param name="height">100%</param>
                    </module>
                </module>  
            </module>
        </module>

Can anyone advise me on where I may be going wrong with this?

Many thanks.

[matthewcanty · Accepted solution]

Thanks for your suggestions Sideview. I was reviewing the documentation: http://docs.splunk.com/Documentation/Splunk/4.3.3/Developer/PostProcess and noted that the only difference was my height element being 100% and theirs being 400px. I changed mine to pixels and unbelievably it worked.

Change:


To:

[sideview]

Now that I see the screenshot I think I have a good guess.
FlashChart is very tricky when it's put into a custom floated layout with custom CSS.
The communication between browser and flash, and the communication between splunk framework and Flash, about when to re-render the flash canvas, can get confused by the floats.

As a result.

1) changing to JSChart, I'll bet fixes the problem entirely.

2) temporarily unfloating the floats will probably also fix the problem.

3) sometimes you can get away with just putting position:relative on the floated elements and this will help with render-pass problems. (although it can also slow down css rendering).

4) if all else fails, but unfloating the charts does fix it, then just keep tinkering with the floated CSS

[sideview]

Well now you're getting somewhere at least. That means it was indeed a float problem or one way or another, a rendering problem with FlashChart. And it means that in addition to that problem, you also have a problem whereby your search result doesn't return anything that either chart module can graph. Put a SimpleResultsTable there for now to see what is there... Maybe there's no results at all and the JSChart messaging is just confused, or maybe you're graphing non-numeric fields or something.

[matthewcanty]

Thanks for the info, this is very useful and I'm sure there is an answer here. I changed 'FlashChart' to 'JSChart' and now displays 'Search did not generate any statistical results.'

[matthewcanty]

Thanks, I've changed everything but the hiddensearches to auto run. I have updated the question to include a screen shot of what is happening. All this runs of a single real-time search. Missing 3 flash charts though.

[sideview]

You want to be very careful about having more than one autoRun="True" in a given path in the XML tree. This can can in some cases cause nasty problems with inconsistent state in the UI. Remove the more downstream autoRun="True" attribute(s) and leave the more upstream one.