All Apps and Add-ons

Custom Visualizations Box Plot not rendering

derekarnold
Communicator

Hi Splunkers,
Has anyone seen an issue where the Box Plot chart fails to render?
This environment is a 6.3.1 SH running on Windows. Indexers are 6.2.4.
We took a clean install of Custom Visualizations and just changed the search on the Box Plot dashboard and replaced with our own search. As you can see in the bottom the search is good and matches up with the example search.
The box plot always fails to load.
In the error logs we see an error with the file: boxplot.js which appears to draw the y axis.
Any assistance would be helpful.

Screenshots here:
http://imgur.com/a/TyAEy

Here's our search stanza:
http://imgur.com/vQhB5p4

0 Karma
1 Solution

mikev
Path Finder

It looks like we found the issue, the timechart span was 1 d but boxplot didn't seem to like that so by changing it to 24h it works

timechart span=24h

View solution in original post

0 Karma

mikev
Path Finder

It looks like we found the issue, the timechart span was 1 d but boxplot didn't seem to like that so by changing it to 24h it works

timechart span=24h

0 Karma

mikev
Path Finder

As a side the original search that produces Visualization:

| tstats prestats=t count where index=_internal by sourcetype _time | timechart span=1m limit=5 useother=f count by sourcetype | fields - _time

The search that does not:

index=foo Classification=bar | dedup fooKey | timechart span=1d limit=5 useother=f count by user| fields - _time

both produce a summary table containing field names and counts

0 Karma

aljohnson_splun
Splunk Employee
Splunk Employee

1.) What browser are you using ?

2.) I added a boxplot to this app if you want to try a different visualization.

0 Karma

mikev
Path Finder

Working with Derek on this. We are using firefox, have also tried it on Chrome.

The interesting component here is the only change made to the sample is the search and truly only the index and subtype of the index, the time can remain he same. one produces visualization, one does not.

We looked at the D3 add-on, but it didn't look as straight forward for our needs, it is pulling from a CSV, we need this to be dynamic as one dashboard will feed this when clicked on. If you have a sting to make it work with indexed data, I'll give it a shot.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...