topic Re: Subsequent Flash Charts Not Appearing in Dashboards & Visualizations

Subsequent Flash Charts Not Appearing

matthewcanty — Tue, 07 Aug 2012 09:05:54 GMT

I have a search with hidden post processes. I have managed to get this working with SingleValues having multiple searches going on, but I can't get beyond one chart with flash charts. The view doesn't fail, it just leaves empty chart space.

<module name="HiddenSearch" layoutPanel="panel_row2_col1_grp1" autoRun="True">
    <param name="search">
        host="*90*" FeedSource="*" | fields _time Fixture FixtureState Selection MarketPrice Action * | sort _time desc
    </param>
    <param name="earliest">rt-1d</param>
    <param name="latest">rt</param>

    <module name="EnablePreview">
        <param name="enable">true</param>
        <param name="display">false</param>

... ...

<module name="GenericHeader" layoutPanel="panel_row3_col1_grp1" autoRun="True">
            <param name="label">Fixture Caches</param>
            <module name="HiddenPostProcess" layoutPanel="panel_row3_col1_grp1">
                <param name="search">
                    search Fixture>0 | stats max(_time) As LatestTime By Action | eval Gap=time()-LatestTime | chart last(Gap) As "Seconds Since Last Event" By Action
                </param>
                <module name="HiddenChartFormatter">    
                    <param name="chart">column</param>
                    <param name="legend.placement">none</param>
                    <module name="FlashChart">
                        <param name="width">100%</param>
                        <param name="height">100%</param>
                    </module>
                </module>  
            </module>
        </module>
        <module name="GenericHeader" layoutPanel="panel_row3_col1_grp2" autoRun="True">
            <param name="label">Fixture State Caches</param>
            <module name="HiddenPostProcess" layoutPanel="panel_row3_col1_grp2">
                <param name="search">
                    search FixtureState>0 | stats max(_time) As LatestTime By Action | eval Gap=time()-LatestTime | chart last(Gap) As "Seconds Since Last Event" By Action
                </param>
                <module name="HiddenChartFormatter">    
                    <param name="chart">column</param>
                    <param name="legend.placement">none</param>
                    <module name="FlashChart">
                        <param name="width">100%</param>
                        <param name="height">100%</param>
                    </module>
                </module>  
            </module>
        </module>

Can anyone advise me on where I may be going wrong with this?

Many thanks.

Re: Subsequent Flash Charts Not Appearing

sideview — Tue, 07 Aug 2012 16:20:58 GMT

You want to be very careful about having more than one autoRun="True" in a given path in the XML tree. This can can in some cases cause nasty problems with inconsistent state in the UI. Remove the more downstream autoRun="True" attribute(s) and leave the more upstream one.

Re: Subsequent Flash Charts Not Appearing

matthewcanty — Tue, 07 Aug 2012 16:35:08 GMT

Thanks, I've changed everything but the hiddensearches to auto run. I have updated the question to include a screen shot of what is happening. All this runs of a single real-time search. Missing 3 flash charts though.

Re: Subsequent Flash Charts Not Appearing

sideview — Tue, 07 Aug 2012 16:47:33 GMT

Now that I see the screenshot I think I have a good guess.
FlashChart is very tricky when it's put into a custom floated layout with custom CSS.
The communication between browser and flash, and the communication between splunk framework and Flash, about when to re-render the flash canvas, can get confused by the floats.

As a result.

1) changing to JSChart, I'll bet fixes the problem entirely.

2) temporarily unfloating the floats will probably also fix the problem.

3) sometimes you can get away with just putting position:relative on the floated elements and this will help with render-pass problems. (although it can also slow down css rendering).

4) if all else fails, but unfloating the charts does fix it, then just keep tinkering with the floated CSS

Re: Subsequent Flash Charts Not Appearing

matthewcanty — Wed, 08 Aug 2012 08:24:01 GMT

Thanks for the info, this is very useful and I'm sure there is an answer here. I changed 'FlashChart' to 'JSChart' and now displays 'Search did not generate any statistical results.'

Re: Subsequent Flash Charts Not Appearing

matthewcanty — Wed, 08 Aug 2012 10:24:53 GMT

Thanks for your suggestions Sideview. I was reviewing the documentation: http://docs.splunk.com/Documentation/Splunk/4.3.3/Developer/PostProcess and noted that the only difference was my height element being 100% and theirs being 400px. I changed mine to pixels and unbelievably it worked.

Change:

100%
100%

To:

100%
400px

Re: Subsequent Flash Charts Not Appearing

sideview — Wed, 08 Aug 2012 16:10:26 GMT

Well now you're getting somewhere at least. That means it was indeed a float problem or one way or another, a rendering problem with FlashChart. And it means that in addition to that problem, you also have a problem whereby your search result doesn't return anything that either chart module can graph. Put a SimpleResultsTable there for now to see what is there... Maybe there's no results at all and the JSChart messaging is just confused, or maybe you're graphing non-numeric fields or something.