topic splunk 4.3 - searchPostProcess on chart component not working in Splunk Search

splunk 4.3 - searchPostProcess on chart component not working

chusi — Thu, 12 Jan 2012 14:04:07 GMT

After upgrading to 4.3 our custom forms with a chart component started to show up the following error:

Search did not generate any statistical results.

The table and event component still works with the searchPostProcess statement as expected, only the chart fails.

The following is some example code which fails in splunk 4.3 but worked before.

<form>
  <searchTemplate>index=*</searchTemplate>
  <label>Test PostProcess</label>
  <fieldset>
    <input type="time" />
  </fieldset>

 <row>
  <chart>
      <title>Test Chart</title>
      <searchPostProcess>timechart count</searchPostProcess>
      <option name="charting.chart">column</option>
  </chart>
</row>
</form>

If i do the the same search directly in the chart component, it works as expected...

<form>
  <!--<searchTemplate>index=*</searchTemplate>-->
  <label>Test PostProcess</label>
  <fieldset>
      <input type="time" />
  </fieldset>

    <row>
      <chart>
          <title>Test Chart</title>
          <searchTemplate>index=* | timechart count</searchTemplate>
          <option name="charting.chart">column</option>
      </chart>

  </row>
  </form>

somebody having the same problem? or even know a solution?

Re: splunk 4.3 - searchPostProcess on chart component not working

swdonline — Tue, 17 Jan 2012 01:26:51 GMT

Same problem here...

   <form>

   <label>Class Miner v2.0</label>

    <searchTemplate>index="*" | fillnull value=NULL | search $name$ $class$ $grade$</searchTemplate>

    <fieldset>

        <input type="dropdown" token="name">
            <populatingSearch fieldForValue="name" fieldForLabel="name"><![CDATA[index="summary_names" | fields
 name | dedup name | sort name ]]></populatingSearch>
            <prefix>name="</prefix>
            <suffix>"</suffix>
            <choice value="*">Any</choice>
            <default>Any</default>
        </input>

        <input type="dropdown" token="class">
            <prefix>class="</prefix>
            <suffix>"</suffix>
            <choice value="*">Any</choice>
            <choice value="CS">CompSci</choice>
            <choice value="EN">English</choice>
            <choice value="HI">History</choice>
            <choice value="MA">Math</choice>
            <default>Any</default>
        </input>

        <input type="dropdown" token="grade">
            <populatingSearch fieldForValue="grade" fieldForLabel="grade"><![CDATA[index="summary_grades" | fields grade | dedup grade | sort grade]]></populatingSearch>
            <prefix>grade="</prefix>
            <suffix>"</suffix>
            <choice value="*">Any</choice>
            <default>Any</default>
        </input>
    </fieldset>
    <row>
        <chart>
            <title>Grades By Class</title>
            <searchPostProcess>search class!="Unknown"| timechart count by class</searchPostProcess> 
            <option name="charting.chart">area</option>
            <option name="charting.legend.placement">right</option>
            <option name="charting.chart.stackMode">stacked</option>
            <option name="charting.layout.splitSeries">True</option>
        </chart>
   </row>
</form>

Re: splunk 4.3 - searchPostProcess on chart component not working

rruijgrok — Wed, 18 Jan 2012 09:17:05 GMT

Had the same problem.
The fix described in this post link text

worked for me.
Just add <option name="charting.scaleX">1</option> to the chart.

Also found that not all fields were available for searchPostProcess (the fields extracted at search time)
Fixed that by adding '| field + *' in the searchTemplate.

Re: splunk 4.3 - searchPostProcess on chart component not working

chusi — Wed, 18 Jan 2012 09:44:36 GMT

great! that totally fixed it! thank you very much!

Re: splunk 4.3 - searchPostProcess on chart component not working

swdonline — Wed, 18 Jan 2012 20:38:48 GMT

That got the chart showing again, but with sparklines. It's no longer honoring stackmode: "stacked"

Re: splunk 4.3 - searchPostProcess on chart component not working

swdonline — Wed, 18 Jan 2012 20:40:24 GMT

Disregard. I had to change "splitSeries" to false. Worked great. Thanks!

Re: splunk 4.3 - searchPostProcess on chart component not working

Simon_Fishel — Wed, 25 Jan 2012 04:28:05 GMT

This is a bug in the new non-Flash charting module. It crops up when the base search of a post-process operation is not itself a reporting search. We're tracking the issue and it will likely be fixed soon.

In the meantime, if you don't want to switch the chart to Flash, you can also work around it by making the base search a reporting search (which is recommended practice anyway). Check out the docs for a full explanation, the gist is that you'll need to add a reporting command in the base search that includes all of the fields that are being used downstream.

Re: splunk 4.3 - searchPostProcess on chart component not working

rruijgrok — Wed, 25 Jan 2012 08:21:57 GMT

The above answer by Simon only works if the view is displaying graphs only and each event contains the same fields.
My view displays graphs, tables and events based upon 1 base search and events do not necessarily have the same fields.

Also I do not want aggregation or statistics in the base search, as it kills the event display.

Re: splunk 4.3 - searchPostProcess on chart component not working

Simon_Fishel — Wed, 07 Mar 2012 03:24:40 GMT

This configuration should now work with the JSChart module in 4.3.1