topic Re: Null results on timechart using base search in Splunk Search

Null results on timechart using base search

3DGjos — Fri, 24 May 2019 05:45:16 GMT

Hello, im making a dashboard with a timechart and some filters, I can't make it to work, my filter gives no results and my linechart shows only a weird count of NULLS. Weird thing is that, if I click on "open in search", my search works.

Here are my inputs:

<search id="base1">
    <query>index=XXX ("XXXCreateEmptyGame: GameInfo:") action=created  game!=*XX* 
         </query>
 <earliest>$time.earliest$</earliest>
    <latest>$time.latest$</latest>
  </search>  

<input type="time" token="time" searchWhenChanged="true">
        <label>time</label>
        <default>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </default>
      </input>

      <input type="multiselect" token="character" searchWhenChanged="true">
        <label>Filtrar by char</label>
        <choice value="*">TODOS</choice>
        <initialValue>*</initialValue>
        <valuePrefix>character="</valuePrefix>
        <valueSuffix>"</valueSuffix>
        <delimiter> OR </delimiter>
        <search base="base1">
          <query>  stats      count(action) AS "countx" by character  |head 10| sort - "countx" | fields - "countx"</query>
        </search>
      </input>
      <chart>
        <title>total amount</title>
        <search base="base1">
          <query>timechart  span=1h useother=f count(action) AS "count2" by character  | sort - "count2"</query>
        </search>
        <option name="charting.chart">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.showDataLabels">all</option>
        <option name="charting.drilldown">none</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="refresh.display">progressbar</option>
      </chart>
    </panel>
  </row>

Any help is welcome, thanks!

Re: Null results on timechart using base search

kamlesh_vaghela — Fri, 24 May 2019 06:04:03 GMT

@3DGjos

Try by mentioning required fields only in base search.

index=XXX ("XXXCreateEmptyGame: GameInfo:") action=created  game!=*XX* | table _time action character

index=XXX ("XXXCreateEmptyGame: GameInfo:") action=created  game!=*XX* | fields _time action character

Re: Null results on timechart using base search

3DGjos — Tue, 28 May 2019 01:25:00 GMT

Thanks! it worked!

Re: Null results on timechart using base search

3DGjos — Tue, 28 May 2019 01:28:46 GMT

Can't mark it as the answer :S

Re: Null results on timechart using base search

MuS — Tue, 28 May 2019 03:02:40 GMT

you could also just use timechart span=1h useother=f count(action) AS "count2" by character usenull=f but to limit or filter on the fields in the base search is much better 😉

cheers, MuS