All Apps and Add-ons

Custom Visualizations Box Plot not rendering

derekarnold
Communicator

Hi Splunkers,
Has anyone seen an issue where the Box Plot chart fails to render?
This environment is a 6.3.1 SH running on Windows. Indexers are 6.2.4.
We took a clean install of Custom Visualizations and just changed the search on the Box Plot dashboard and replaced with our own search. As you can see in the bottom the search is good and matches up with the example search.
The box plot always fails to load.
In the error logs we see an error with the file: boxplot.js which appears to draw the y axis.
Any assistance would be helpful.

Screenshots here:
http://imgur.com/a/TyAEy

Here's our search stanza:
http://imgur.com/vQhB5p4

0 Karma
1 Solution

mikev
Path Finder

It looks like we found the issue, the timechart span was 1 d but boxplot didn't seem to like that so by changing it to 24h it works

timechart span=24h

View solution in original post

0 Karma

mikev
Path Finder

It looks like we found the issue, the timechart span was 1 d but boxplot didn't seem to like that so by changing it to 24h it works

timechart span=24h

0 Karma

mikev
Path Finder

As a side the original search that produces Visualization:

| tstats prestats=t count where index=_internal by sourcetype _time | timechart span=1m limit=5 useother=f count by sourcetype | fields - _time

The search that does not:

index=foo Classification=bar | dedup fooKey | timechart span=1d limit=5 useother=f count by user| fields - _time

both produce a summary table containing field names and counts

0 Karma

aljohnson_splun
Splunk Employee
Splunk Employee

1.) What browser are you using ?

2.) I added a boxplot to this app if you want to try a different visualization.

0 Karma

mikev
Path Finder

Working with Derek on this. We are using firefox, have also tried it on Chrome.

The interesting component here is the only change made to the sample is the search and truly only the index and subtype of the index, the time can remain he same. one produces visualization, one does not.

We looked at the D3 add-on, but it didn't look as straight forward for our needs, it is pulling from a CSV, we need this to be dynamic as one dashboard will feed this when clicked on. If you have a sting to make it work with indexed data, I'll give it a shot.

0 Karma
Get Updates on the Splunk Community!

Splunk Certification Support Alert | Pearson VUE Outage

Splunk Certification holders and candidates!  Please be advised of an upcoming system maintenance period for ...

Enterprise Security Content Update (ESCU) | New Releases

In September, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...

New in Observability - Improvements to Custom Metrics SLOs, Log Observer Connect & ...

The latest enhancements to the Splunk observability portfolio deliver improved SLO management accuracy, better ...