topic Re: Query not plotting multi-series line chart in Dashboards & Visualizations

Why is query not plotting multi-series line chart?

Jeet — Thu, 01 Sep 2022 15:47:11 GMT

| regex "message.message"="Total count XXXXXX: |Total rows YYYYYY: " | rex field="message.message" max_match=0 "^(?<msg1>[^:]*)\:(?<msg2>[^:]*)\:(?<msg3>[^:]*)\:(?<msg4>[^:]*)($|\{)" | eval dtonly=strftime(_time, "%Y%m%d") | chart first(msg4) OVER dtonly BY msg3

I get the stats but not the visualization.

Thanks

Re: Query not plotting multi-series line chart

ITWhisperer — Thu, 01 Sep 2022 14:03:36 GMT

Can you share some events in a code block </> so we can better see what you are dealing with?

Re: Query not plotting multi-series line chart

Jeet — Thu, 01 Sep 2022 14:12:39 GMT

It's a glue job log output, something like this. one run per day.

INFO:__main__:Total rows: 893

...

INFO:__main__:Total count in segments schema: 18504

Re: Query not plotting multi-series line chart

Jeet — Thu, 01 Sep 2022 14:55:59 GMT

Is that what you are looking for? Sorry! I am new to Splunk.

Re: Query not plotting multi-series line chart

BlueSocket — Thu, 01 Sep 2022 15:22:35 GMT

@Jeet, you might want to check the maximum number of values that are supported by the visualization that you have selected to output. I have had this happen to me - I can see the (>50,000) values, but the visualization only supports 50,000 rows. That >18,000 might be too high.

Re: Query not plotting multi-series line chart

Jeet — Thu, 01 Sep 2022 15:28:36 GMT

Data to be plotted won't be more than 50 rows. Enclosing stat output for 2 rows which is not getting plotted.

Re: Query not plotting multi-series line chart

BlueSocket — Thu, 01 Sep 2022 15:40:23 GMT

So.... What do you see when you switch to the visualization and which visualization are you trying to use?

Re: Query not plotting multi-series line chart

ITWhisperer — Thu, 01 Sep 2022 15:46:20 GMT

It looks like you might have a space between the : and the numbers. The values are left aligned, indicating a string rather than a numeric. Try accounting for the space (if it is there) and only extract digits for msg4.

| rex field="message.message" max_match=0 "^(?<msg1>[^:]*)\:(?<msg2>[^:]*)\:(?<msg3>[^:]*)\:\s*(?<msg4>\d*)"

Re: Query not plotting multi-series line chart

Jeet — Thu, 01 Sep 2022 15:54:24 GMT

That did the trick. Thank you!!