topic Re: : NULL in legend in Dashboards & Visualizations

: NULL in legend

ctallarico20 — Mon, 17 Jun 2013 12:45:48 GMT

Hi, I'm wondering why the search "RESULTS"| timechart span=1d sum(SUCCESS) as "Successes" sum(FAILURE) as "Failures" by RESULTS displays a : NULL in the legend. For example, my legend reads SUCCESSES: NULL and FAILURES: NULL although the data is displayed correctly/ I think this has something to do with the fact that my logs don't always have both a success and fail count, it's usually one or the other.

Re: : NULL in legend

Gilberto_Castil — Mon, 17 Jun 2013 13:05:03 GMT

The timechart command has an optional flag to avoid NULL values. Try this:

 ... "RESULTS" | timechart span=1d sum(SUCCESS) as "Successes" sum(FAILURE) as "Failures" by RESULTS usenull=false

Re: : NULL in legend

ctallarico20 — Mon, 17 Jun 2013 13:06:40 GMT

I appreciate the help, but I believe this only filters the result "NULL" from the timechart. I have the suffix ": NULL" added to all of my data

Re: : NULL in legend

Gilberto_Castil — Mon, 17 Jun 2013 13:10:01 GMT

This points to the data extraction not having the right context. Would you be able to quote two or three lines from the tabular display?

Re: : NULL in legend

ctallarico20 — Mon, 17 Jun 2013 13:43:50 GMT

[2013-06-03 11:38:40:66 EDT] RESULTS FAILURE=5 [2013-06-03 11:38:40:66 EDT] RESULTS SUCCESS=15

Re: : NULL in legend

Gilberto_Castil — Mon, 17 Jun 2013 16:12:04 GMT

Thanks for posting the sample data. I can replicate the condition you describe. The culprit is the "by RESULTS" clause because it is trying to group the results by the field RESULTS. Try this:

"RESULTS"| timechart span=1d sum(SUCCESS) as "Successes" sum(FAILURE) as "Failures"

Re: : NULL in legend

ctallarico20 — Mon, 17 Jun 2013 18:06:06 GMT

you got it! thank you so much!