JSChart Search PostProcess: Search did not generate any statistical results.

[bojank]

Hello,

I'm trying to move new apps on Splunk 4.3 to JSChart however I have problems with the following error when using PostProcess search: Search did not generate any statistical results.

If I click few times on link switcher the search will appear.

Anyone found any solution?

<module name="StaticContentSample" layoutPanel="viewHeader">
    <param name="text">&lt;/p&gt;&lt;ul&gt;&lt;li&gt;&lt;strong&gt;&lt;a href="https://ocx/en-US/app/noss/fw_conn_formsearch"&gt;Firewall Connections Detail Form Search</param>
</module>

<module name="Search" layoutPanel="panel_row1_col1_grp2" autoRun="True">
    <param name="search">eventtype="firewall_conn_count" | dedup error_code | rangemap field=active_conn low=0-1000 elevated=1001-2000 default=severe</param>
    <param name="earliest">-1h</param>
    <module name="SingleValue">
        <param name="field">active_conn</param>
        <param name="classField">range</param>
        <param name="beforeLabel">Active Connections:</param>
    </module>
</module>
<module name="Search" layoutPanel="panel_row1_col1_grp3" autoRun="True">
    <param name="search">eventtype="firewall_conn_count" | dedup error_code | rangemap field=max_conn low=0-5000 elevated=5001-9000 default=severe</param>
    <param name="earliest">-1h</param>
    <module name="SingleValue">
        <param name="field">max_conn</param>
        <param name="classField">range</param>
        <param name="beforeLabel">Max Connections:</param>
    </module>
</module>

<module name="TimeRangePicker" layoutPanel="panel_row1_col1_grp1"><!-- Start TimeRangePicker -->
    <param name="searchWhenChanged">True</param>
    <param name="default">Today</param>

    <module name="Search" layoutPanel="panel_row2_col1" autoRun="True"><!-- Start Connection Timeline  Search -->
        <param name="search">index="firewall_summary" stype="firewall_conn" | timechart span=1m sum(Built) as Built sum(Teardown) as Teardown</param>
        <module name="JobProgressIndicator"/>
        <module name="HiddenChartFormatter">
            <param name="charting.legend.placement">bottom</param>
            <param name="charting.primaryAxisTitle.text">Event Count</param>
            <param name="charting.secondaryAxisTitle.text">Time</param>
            <param name="charting.chart">line</param>
            <param name="charting.fieldColors">{"Teardown":0xE51B1A,"Built":0x6C943B}</param>
            <module name="JSChart">
                <module name="Gimp"/>
                <param name="width">100%</param>
                <param name="height">250px</param>
            </module>
        </module>
    </module><!-- End Connection Timeline  Search -->

    <module name="Search" layoutPanel="panel_row3_col1" autoRun="True"><!-- Start Connection Charts  Search -->
        <param name="search">eventtype="firewall_build_conn" conn_src_int="*" conn_src_host_local="*" conn_src_port_local="*" conn_src_host_global="*" conn_src_port_global="*" conn_dest_int="*" conn_dest_host_local="*" conn_dest_port_local="*" conn_dest_host_global="*" conn_dest_port_global="*" conn_id="*" conn_protocol="*" conn_type="*"</param>
        <module name="LinkSwitcher" group="IP Address Details" layoutPanel="panel_row3_col1"><!-- Start IP Address Details Link Switcher -->
            <param name="mode">independent</param>
            <param name="label">Use the links bellow to switch between charts</param>
            <module name="PostProcess" group="by Local Source IP" autoRun="True">
                <param name="search">| stats count by conn_src_host_local | head 20</param>
                <module name="HiddenChartFormatter">
                    <param name="charting.legend.placement">none</param>
                    <param name="charting.chart">pie</param>
                    <module name="JSChart">
                <module name="Gimp"/>

                        <param name="width">100%</param>
                        <param name="height">250px</param>
                    </module>
                </module>
            </module>
            <module name="PostProcess" group="by Local Destination IP" autoRun="False">
                <param name="search">| stats count by conn_dest_host_local | head 20</param>
                <module name="HiddenChartFormatter">
                    <param name="charting.legend.placement">none</param>
                    <param name="charting.chart">pie</param>
                    <module name="JSChart">
                <module name="Gimp"/>

                        <param name="width">100%</param>
                        <param name="height">250px</param>
                    </module>
                </module>
            </module>
            <module name="PostProcess" group="by Global Source IP" autoRun="False">
                <param name="search">| stats count by conn_src_host_global | head 20</param>
                <module name="HiddenChartFormatter">
                    <param name="charting.legend.placement">none</param>
                    <param name="charting.chart">pie</param>
                    <module name="JSChart">
                <module name="Gimp"/>

                        <param name="width">100%</param>
                        <param name="height">250px</param>
                    </module>
                </module>
            </module>
            <module name="PostProcess" group="by Global Destination IP" autoRun="False">
                <param name="search">| stats count by conn_dest_host_global | head 20</param>
                <module name="HiddenChartFormatter">
                    <param name="charting.legend.placement">none</param>
                    <param name="charting.chart">pie</param>
                    <module name="JSChart">
                <module name="Gimp"/>

                        <param name="width">100%</param>
                        <param name="height">250px</param>
                    </module>
                </module>
            </module>
        </module><!-- End IP Address Details Link Switcher -->

[Simon_Fishel]

It looks like this might be due to a bug in the JSChart module when a post-process is being performed on a non-reporting search. Take a look at this post for a couple of work-around options.

[Simon_Fishel]

This configuration should now work with the JSChart module in 4.3.1