topic Re: Splunk Dashboard - search returns null in Dashboards & Visualizations

Splunk Dashboard - search returns null

DarrellR — Fri, 31 Jan 2025 14:38:13 GMT

I have created a dashboard that reads a MQ flow that contains messages to different vendors. I have created panels for the different vendors and am trying to group the messages for each of those vendors. Each Vendor will receive 2 message types ASM and SSM. 2 panels work but the other does not, it only returns NULL yet there are messages.

The search is exactly the same for all three with the exception of the Vendor address, here is the search

index="emh_prd" ACXForm="TTYIN:MULEOUT:TTYOUT" XXXXXX AND .YYYYYY
| timechart count by DR1

The XXXXXX is the Vendor address and .YYYYYYY is the sender address. The sender address will stay the same but the each panel will have a different XXXXXX value

I can not figure out why only that 1 does not work and returns NULL when it receives basically the same messages just with a different XXXXXX value

I hope someone here can help me

Re: Splunk Dashboard - search returns null

gcusello — Fri, 31 Jan 2025 14:41:14 GMT

Hi @DarrellR ,

are you sure that all the events have the DR1 field?

you could try to add DR1=* to the main search.

Ciao.

Giuseppe

Re: Splunk Dashboard - search returns null

DarrellR — Fri, 31 Jan 2025 14:48:03 GMT

Hi @gcusello ,

Thanks for the quick reply! I am new to this, where would I add the DR1=* in my search?

Also not all the panels have the DR1 in there events but they still work. This is part of why I don't understand why some work and not others.

Re: Splunk Dashboard - search returns null

DarrellR — Fri, 31 Jan 2025 14:56:30 GMT

Here is the events from left to right for the 3 panels.

So here the DR1 is not showing but the 1st and 3rd panels work but the middle one does not. The characters in the RED box is what the DR1 is looking for either SSM or ASM

Re: Splunk Dashboard - search returns null

isoutamo — Fri, 31 Jan 2025 15:01:13 GMT

Here is your original search

index="emh_prd" ACXForm="TTYIN:MULEOUT:TTYOUT" XXXXXX AND .YYYYYY | timechart count by DR1

You should do it like

index="emh_prd" ACXForm="TTYIN:MULEOUT:TTYOUT" XXXXXX AND .YYYYYY DR1=* | timechart count by DR1

index="emh_prd" ACXForm="TTYIN:MULEOUT:TTYOUT" XXXXXX AND .YYYYYY | eval DR1 = coalesce(DR1, "DR1 N/A") | timechart count by DR1

https://docs.splunk.com/Documentation/Splunk/9.4.0/SearchReference/ConditionalFunctions#coalesce.28.26lt.3Bvalues.29

Re: Splunk Dashboard - search returns null

DarrellR — Fri, 31 Jan 2025 15:16:43 GMT

Thanks but neither of those seem to work, I still get NULL even though there are messages. This is very frustrating

Re: Splunk Dashboard - search returns null

isoutamo — Fri, 31 Jan 2025 15:20:42 GMT

Are you sure that those queries are used on those panels? Or are there some other filtering after those queries which remove all results?

Can you share those panels source and also your sample data (with anonymous values when needed)?

Re: Splunk Dashboard - search returns null

DarrellR — Fri, 31 Jan 2025 15:24:55 GMT

This is panel 1

Re: Splunk Dashboard - search returns null

DarrellR — Fri, 31 Jan 2025 15:26:15 GMT

This is panel 2 [the one showing NULL]

Re: Splunk Dashboard - search returns null

DarrellR — Fri, 31 Jan 2025 15:28:28 GMT

Here is the source for the 2nd panel

<chart>
<title>SchedConnect Messages to {nnnn]</title>
<search>
<query>index="emh_prd" ACXForm="TTYIN:MULEOUT:TTYOUT" XXXXXX AND .YYYYYY
| timechart count by DR1</query>
<earliest>$TimePickerKielToken.earliest$</earliest>
<latest>$TimePickerKielToken.latest$</latest>
<refresh>1m</refresh>
<refreshType>delay</refreshType>
</search>
<option name="charting.axisTitleX.text">Time</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.chart">column</option>
<option name="charting.drilldown">all</option>
<option name="charting.legend.placement">right</option>
<option name="refresh.display">progressbar</option>
<option name="trellis.enabled">0</option>
<option name="trellis.size">medium</option>
</chart>
</panel>
<panel>
<chart>

Re: Splunk Dashboard - search returns null

DarrellR — Fri, 31 Jan 2025 15:29:35 GMT

here is the source for the 1st panel

Re: Splunk Dashboard - search returns null

DarrellR — Fri, 31 Jan 2025 15:43:52 GMT

Here is the source code all together for those panels - left to right, might be easier to debug

<row>
<panel>
<chart>
<title>SchedConnect Messages to [nnnnn]</title>
<search>
<query>index="emh_prd" ACXForm="TTYIN:MULEOUT:TTYOUT" XXXXXX AND .YYYYYY
| timechart count by DR1</query>
<earliest>$TimePickerKielToken.earliest$</earliest>
<latest>$TimePickerKielToken.latest$</latest>
<refresh>1m</refresh>
<refreshType>delay</refreshType>
</search>
<option name="charting.axisTitleX.text">Time</option>
<option name="charting.chart">column</option>
<option name="charting.drilldown">all</option>
<option name="charting.legend.placement">right</option>
<option name="refresh.display">progressbar</option>
</chart>
</panel>
<panel>
<chart>
<title>SchedConnect Messages to {nnnnn]</title>
<search>
<query>index="emh_prd" ACXForm="TTYIN:MULEOUT:TTYOUT" XXXXXX AND .YYYYY
| timechart count by DR1</query>
<earliest>$TimePickerKielToken.earliest$</earliest>
<latest>$TimePickerKielToken.latest$</latest>
<refresh>1m</refresh>
<refreshType>delay</refreshType>
</search>
<option name="charting.axisTitleX.text">Time</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.chart">column</option>
<option name="charting.drilldown">all</option>
<option name="charting.legend.placement">right</option>
<option name="refresh.display">progressbar</option>
</chart>
</panel>
<panel>
<chart>
<title>SchedConnect Messages to [nnnnn]</title>
<search>
<query>index="emh_prd" ACXForm="TTYIN:MULEOUT:TTYOUT" XXXXXX AND .YYYYYY
| timechart count by DR1</query>
<earliest>$TimePickerKielToken.earliest$</earliest>
<latest>$TimePickerKielToken.latest$</latest>
<refresh>1m</refresh>
<refreshType>delay</refreshType>
</search>
<option name="charting.axisTitleX.text">Time</option>
<option name="charting.chart">column</option>
<option name="charting.drilldown">all</option>
<option name="refresh.display">progressbar</option>
</chart>
</panel>

Re: Splunk Dashboard - search returns null

isoutamo — Fri, 31 Jan 2025 15:48:58 GMT

Thanx. Next time when you paste something please use </> code block to avoid character changes etc.

Based on those I suppose that your data haven't correct values what you are looking for. You should check it by clicking magnifying class on right bottom corner of your dashboard's individual panel. This opens exactly same search you to separate window/tab and you can see what events it found. Then you can debug it by e.g. commenting rows away from bottom to top.

Re: Splunk Dashboard - search returns null

DarrellR — Fri, 31 Jan 2025 16:01:29 GMT

Hi @isoutamo ,

I will do that next time I post, thank you. I have checked the search and aside from the XXXXXX values being the address for the different vendors, each panel uses the exact same search, it is just for 1 I get NULL values even though the messages are there when I look at the events

Re: Splunk Dashboard - search returns null

gcusello — Sat, 01 Feb 2025 07:00:19 GMT

Hi @DarrellR ,

as also @isoutamo said, you should put it in the main search.

Ciao.

Giuseppe