topic Re: Why are lines not showing up for line graph? in Dashboards & Visualizations

Why are lines not showing up for line graph?

alanxu — Tue, 01 Sep 2015 15:31:13 GMT

Hello,
I am trying to put multiple lines on a line graph. However, the lines are not showing up. Here is a picture of the panel.

The XML for my dashboard is:

 <row>
    <panel>
      <chart>
        <title>Completion Times of Each "Thing"</title>
        <searchString>host=... source = "..." SP Position="Finished" | eval Completion_Time=tonumber(replace(Completion_Time,"(\d+):(\d+):(\d+)","\1.\2")) | timechart limit=100 latest(TIME) as Completion_Time by FinishedName</searchString>
        <earliestTime>$timetoken.earliest$</earliestTime>
        <latestTime>$timetoken.latest$</latestTime>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.enabled">false</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">line</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.placement">right</option>
        <option name="wrap">true</option>
        <option name="rowNumbers">false</option>
        <option name="dataOverlayMode">none</option>
        <option name="list.drilldown">full</option>
        <option name="list.wrap">1</option>
        <option name="maxLines">5</option>
        <option name="raw.drilldown">full</option>
        <option name="table.drilldown">all</option>
        <option name="table.wrap">1</option>
        <option name="type">list</option>
      </chart>
    </panel>
  </row>

Can anyone give insight on this problem?

Re: Why are lines not showing up for line graph?

alanxu — Tue, 01 Sep 2015 15:32:22 GMT

I would like to have completion time on the y axis.

Re: Why are lines not showing up for line graph?

diogofgm — Tue, 01 Sep 2015 16:13:22 GMT

Do you have a field called TIME? In your search you are showing the latest TIME. If you don't have it, it won't show data.

| timechart limit=100 latest(TIME) as Completion_Time by FinishedName

I don't know much about your data but, taking in consideration the eval i believe you meant to use:

latest(Completion_Time)

Re: Why are lines not showing up for line graph?

sideview — Tue, 01 Sep 2015 16:31:01 GMT

Since you have a legend there, you do have multiple series values in the data itself. So what's probably happening here is that you have "nullValueMode" set to "gaps", and all of the numerical values have a null value in the time bucket before, and a null value in the timebucket after. nullValueMode actually causes this confusion quite often.

with chartType set to line and nullValueMode set to "gaps", (and showMarkers left to its default setting of False), the charting will draw lines on the graph only between consecutive values. So if a point in a given series has null values in the time buckets immediately before and immediately after, that point will not get drawn at all. You can stumble across it by mousing around in the chart randomly. Needless to say this is a little confusing, so much so that it should probably be considered an error state.

Anyway, try changing nullValueMode to "connect" or to "zero" and see which one you like best. Alternately you can revisit the search language generating your chart and depending on the search language there's most likely another way to get the data such that you have no empty values, or explicit zeros there install of nulls.

Here's another answers post showing the same problem and same solution.
http://answers.splunk.com/answers/31519/gaps-in-line-graph.html

Incidentally, one somewhat common way this can arise, is if the underlying data (be it summary index data, or just plain old raw data) has an underlying granularity that is courser than the granularity of the search language you're using. For example you might be charting a value that only gets written to the logs every 30 minutes but you're using a timechart command with span=10min. Such a chart, with this combination of nullValueMode etc, would never be able to chart a single point.

Re: Why are lines not showing up for line graph?

woodcock — Tue, 01 Sep 2015 16:42:54 GMT

You can only timechart numbers and since your TIME field almost certainly has colons and hyphens, Splunk very rightly does not consider this a number so it refuses-to/cannot graph them on the Y-Axis. If you convert TIME to epoch then it will graph but it will be a really strange graph. Click on your graph to drilldown and the click on the Statistics tab and you will see your non-number timechart data. That is the problem.

Re: Why are lines not showing up for line graph?

sideview — Tue, 01 Sep 2015 16:52:16 GMT

Update: Also yes it is crucial that the "TIME" values you're charting are at least vaguely numerical. timechart can be pretty forgiving about noise in there but if TIME doesn't look at all like a number it wont chart anything for latest(TIME)

Re: Why are lines not showing up for line graph?

alanxu — Tue, 01 Sep 2015 16:57:33 GMT

I tried connect and zero, however nothing shows up still.

Re: Why are lines not showing up for line graph?

alanxu — Tue, 01 Sep 2015 16:58:04 GMT

Yes I do have a field called TIME

Re: Why are lines not showing up for line graph?

alanxu — Tue, 01 Sep 2015 16:59:49 GMT

Doing latest(Completion_Time) gives back no results

Re: Why are lines not showing up for line graph?

alanxu — Tue, 01 Sep 2015 17:01:19 GMT

Why will it be a strange graph?

Re: Why are lines not showing up for line graph?

woodcock — Tue, 01 Sep 2015 17:05:05 GMT

It will just be a line growing from the lower-left corner to the upper-right corner if you use epoch. Perhaps your TIME field is really a duration field. If so, try swapping out latest(TIME) with latest(tostring(TIME, "duration")) and that is probably what you are trying to do.

Re: Why are lines not showing up for line graph?

alanxu — Tue, 01 Sep 2015 17:08:41 GMT

And what I did was have it as a stats table first then I tried to convert it to a graph.. And you are correct TIME has colons.

Re: Why are lines not showing up for line graph?

alanxu — Tue, 01 Sep 2015 17:19:50 GMT

Instead of making it a string should I be trying to make it a number so I can graph it? And the TIME is the TIME of the indexed information. I am in mountain time but Splunk is in GMT so I used TIME to get the mountain time.

Re: Why are lines not showing up for line graph?

alanxu — Tue, 01 Sep 2015 17:20:22 GMT

Hmm should I change TIME into a number? By removing the colons

Re: Why are lines not showing up for line graph?

woodcock — Tue, 01 Sep 2015 17:27:23 GMT

If you use strptime to convert your TIME variable to an epoch (which is a number), then your graph will "work" but, as I mentioned, such a visualization is pretty useless.

Re: Why are lines not showing up for line graph?

alanxu — Tue, 01 Sep 2015 17:33:26 GMT

That is true. I think a work around I saw was changing it to a decimal. HH.MM

Re: Why are lines not showing up for line graph?

woodcock — Tue, 01 Sep 2015 18:02:05 GMT

That will work: use strptime to convert to epoch, then use strftime with "%H.%M" to convert to hour-decimal-minute, which will be plottable. Don't forget to click "Accept" to close the question.

Re: Why are lines not showing up for line graph?

alanxu — Tue, 01 Sep 2015 19:09:57 GMT

Thanks woodcock will try out now!