topic Re: SVG vizualization does not generate if there is no data found in All Apps and Add-ons

SVG vizualization does not generate if there is no data found

stanwin — Tue, 13 Nov 2018 18:02:07 GMT

tokens that are passed to the SVG viz xml need to be populated else it will be blank & u will see SVG Error.

Usually in other viz you will see no data found, but here you will get a SVG error text.

host=popeyeOtherEye does not exist i assume

   index=_internal host=popeyeOtherEye
    | stats count 
    | eval KOLOR = case( count > 0,"limegreen",count ==0,"RED" ,true(),"orange")
    |eval svg_viz = "<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"no\"?>
    <!DOCTYPE svg PUBLIC \"-//W3C//DTD SVG 1.1//EN\" \"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd\">
    <svg viewBox=\"0 0 1200 250\" width=\"1200\" height=\"250\">
       <style>
         .small { font: bold  11px Calibri; }
        .heavy { font: bold 20px Calibri; }
      </style>   

      <rect x=\"0\" y=\"20\" rx=\"3\" ry=\"3\" width=\"90\" height=\"40\" style=\"fill:"+KOLOR+";stroke:black;stroke-width:2;opacity:1.0\" /> 

      <text x=\"10\" y=\"50\" fill=\"black\" style=\"opacity:0.8\"   class=\"heavy\"  >"+count+"</text>
      <text x=\"0\" y=\"75\" fill=\"black\" style=\"opacity:0.8\"  class=\"small\" >_internal Count</text>

    </svg> 
    "

Re: SVG vizualization does not generate if there is no data found

stanwin — Tue, 13 Nov 2018 18:05:38 GMT

Posting this to help anyone that has similar issues.

Although you probably would do this for even non svg vizualizations!

use an eval with coalesce or whatever you prefer to set default catch all value for all the tokens passed to the svg viz xml..

index=_internal 
| stats count 
| eval count = coalesce(count,"0")
| eval KOLOR = case( count > 0,"limegreen",count ==0,"RED" ,true(),"orange")

Re: SVG vizualization does not generate if there is no data found

msivill_splunk — Tue, 13 Nov 2018 20:52:49 GMT

Good catch and workaround.

I'll need to dig into how to fix this the next time I get to look at the code behind the SVG app.

Re: SVG vizualization does not generate if there is no data found

msivill_splunk — Tue, 16 Apr 2019 16:58:28 GMT

Version 3.0.1 of the Scalable Vector Graphics - Custom Visualization app has been updated to show different error messages.

If there are no events from the query results then
the standard "No results found" will
be returned
Errors with the svg_viz
field not appearing in the query results or not having a value will return "SVG field error"
Errors with bad SVG in
svg_viz filed will return "SVG parse
error"

While this does not solve the original issue it should help narrow down any potential issues quicker by identifying where the error may be.