All Apps and Add-ons

Custom Visualizations Box Plot not rendering

derekarnold
Communicator

Hi Splunkers,
Has anyone seen an issue where the Box Plot chart fails to render?
This environment is a 6.3.1 SH running on Windows. Indexers are 6.2.4.
We took a clean install of Custom Visualizations and just changed the search on the Box Plot dashboard and replaced with our own search. As you can see in the bottom the search is good and matches up with the example search.
The box plot always fails to load.
In the error logs we see an error with the file: boxplot.js which appears to draw the y axis.
Any assistance would be helpful.

Screenshots here:
http://imgur.com/a/TyAEy

Here's our search stanza:
http://imgur.com/vQhB5p4

0 Karma
1 Solution

mikev
Path Finder

It looks like we found the issue, the timechart span was 1 d but boxplot didn't seem to like that so by changing it to 24h it works

timechart span=24h

View solution in original post

0 Karma

mikev
Path Finder

It looks like we found the issue, the timechart span was 1 d but boxplot didn't seem to like that so by changing it to 24h it works

timechart span=24h

0 Karma

mikev
Path Finder

As a side the original search that produces Visualization:

| tstats prestats=t count where index=_internal by sourcetype _time | timechart span=1m limit=5 useother=f count by sourcetype | fields - _time

The search that does not:

index=foo Classification=bar | dedup fooKey | timechart span=1d limit=5 useother=f count by user| fields - _time

both produce a summary table containing field names and counts

0 Karma

aljohnson_splun
Splunk Employee
Splunk Employee

1.) What browser are you using ?

2.) I added a boxplot to this app if you want to try a different visualization.

0 Karma

mikev
Path Finder

Working with Derek on this. We are using firefox, have also tried it on Chrome.

The interesting component here is the only change made to the sample is the search and truly only the index and subtype of the index, the time can remain he same. one produces visualization, one does not.

We looked at the D3 add-on, but it didn't look as straight forward for our needs, it is pulling from a CSV, we need this to be dynamic as one dashboard will feed this when clicked on. If you have a sting to make it work with indexed data, I'll give it a shot.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...