topic Re: When I use timechart, I get a visual. When I use chart, no results. Any idea why? in Splunk Search

When I use timechart, I get a visual. When I use chart, no results. Any idea why?

zeroCalm — Tue, 19 Sep 2017 14:33:12 GMT

Hello,

I am using the following search:

index="ips_snaplogic""postsales" lvl="ERROR"| spath| rex mode=sed "s/.*{/{/"
| spath output=msg path=Detail.error.message.message
| timechart count BY msg

THis is the JSON I am trying to drill into, and grab the error message that I am trying to divide the chart by.

//XXX/projects/Sales_PostSales_processPostSaleOrder_VIP_CCT:{  
   "Service":"Enterprise Sales",
   "Date":"09/19/2017 08:44:41.466",
   "Environment":"XXX",
   "Debug":"Error",
   "Source":"PostSalesIntegration",
   "Description":"Error::processPostSaleOrder_VIP_CCT. Error occurred while trying to process the message. Failed to execute HTTP request",
   "Message_Unique_Id":null,
   "Message_qualifier":null,
   "JMSMessageID":null,
   "Detail":{  
      "error":{  
         "message":"Failed to execute HTTP request",
         "reason":"Read timed out",
         "resolution":"Please check the Snap properties."
      }

When I use timechart, I get a visual. When I use chart, no results. Any idea why?

Thanks

Re: When I use timechart, I get a visual. When I use chart, no results. Any idea why?

DalJeanis — Tue, 19 Sep 2017 14:36:06 GMT

Try this and see what happens...

index="ips_snaplogic""postsales" lvl="ERROR"
| spath
| rex mode=sed "s/.*{/{/"
| spath output=msg path=Detail.error.message
| bin _time span=1h 
| chart count BY msg _time

Updated to eliminate extra ".message"

Re: When I use timechart, I get a visual. When I use chart, no results. Any idea why?

gcusello — Tue, 19 Sep 2017 14:36:58 GMT

Hi zeroCalm,
what options do you use in chart command ?
Bye.
Giuseppe

Re: When I use timechart, I get a visual. When I use chart, no results. Any idea why?

zeroCalm — Tue, 19 Sep 2017 14:42:32 GMT

Thanks for the response, I am having the same results though.

Re: When I use timechart, I get a visual. When I use chart, no results. Any idea why?

zeroCalm — Tue, 19 Sep 2017 14:43:18 GMT

Options? I don't believe I understand the question. The original question shows my entire search string.

Re: When I use timechart, I get a visual. When I use chart, no results. Any idea why?

gcusello — Tue, 19 Sep 2017 14:47:16 GMT

did you tried something like this using chart instead timechart?

index="ips_snaplogic""postsales" lvl="ERROR"
| spath
| rex mode=sed "s/.*{/{/"
| spath output=msg path=Detail.error.message.message
| bin _time span=1h 
| chart count over _time BY msg

Bye.
Giuseppe

Re: When I use timechart, I get a visual. When I use chart, no results. Any idea why?

somesoni2 — Tue, 19 Sep 2017 15:07:14 GMT

What's your query with chart command? What is the expected visualization with chart command?

Re: When I use timechart, I get a visual. When I use chart, no results. Any idea why?

zeroCalm — Tue, 19 Sep 2017 15:16:17 GMT

Now I am getting a chart, but the error message isnt showing.

Here is a screenshot.

https://imgur.com/a/NZTJC

Thanks again.

Re: When I use timechart, I get a visual. When I use chart, no results. Any idea why?

gcusello — Tue, 19 Sep 2017 15:18:31 GMT

revie the message field extraction
Bye.
Giuseppe

Re: When I use timechart, I get a visual. When I use chart, no results. Any idea why?

zeroCalm — Tue, 19 Sep 2017 15:55:39 GMT

I have updated my original question.

Re: When I use timechart, I get a visual. When I use chart, no results. Any idea why?

DalJeanis — Tue, 19 Sep 2017 16:07:03 GMT

@zerocalm - try again. There was an extra .message in the code, probably inserted somehow when you changed timechart to chart.

|makeresults 
| eval _raw="//XXX/projects/Sales_PostSales_processPostSaleOrder_VIP_CCT:{  
    \"Service\":\"Enterprise Sales\",
    \"Date\":\"09/19/2017 08:44:41.466\",
    \"Environment\":\"XXX\",
    \"Debug\":\"Error\",
    \"Source\":\"PostSalesIntegration\",
    \"Description\":\"Error::processPostSaleOrder_VIP_CCT. Error occurred while trying to process the message. Failed to execute HTTP request\",
    \"Message_Unique_Id\":null,
    \"Message_qualifier\":null,
    \"JMSMessageID\":null,
    \"Detail\":{  
       \"error\":{  
          \"message\":\"Failed to execute HTTP request\",
          \"reason\":\"Read timed out\",
          \"resolution\":\"Please check the Snap properties.\"
       }"
| spath
| rex mode=sed "s/.*{/{/"
| spath output=msg path=Detail.error.message

Re: When I use timechart, I get a visual. When I use chart, no results. Any idea why?

zeroCalm — Tue, 19 Sep 2017 16:21:46 GMT

Thanks, I removed the extra .message, and I am still getting the same results.

Screenshot:

https://imgur.com/PQA6itN

Re: When I use timechart, I get a visual. When I use chart, no results. Any idea why?

somesoni2 — Tue, 19 Sep 2017 16:32:40 GMT

Could you also post the query that you use with chart command? Do you select pie visualization for both?

Re: When I use timechart, I get a visual. When I use chart, no results. Any idea why?

s2_splunk — Tue, 19 Sep 2017 16:55:02 GMT

This | spath output=msg path=Detail.error.message.message should be replaced with this | spath output=msg path=Detail.error.message

Re: When I use timechart, I get a visual. When I use chart, no results. Any idea why?

gcusello — Wed, 20 Sep 2017 11:12:44 GMT

If this answer satisfies your question, please accept or upvote it.
Bye.
Giuseppe