SVG vizualization does not generate if there is no data found

[stanwin]

tokens that are passed to the SVG viz xml need to be populated else it will be blank & u will see SVG Error.

Usually in other viz you will see no data found, but here you will get a SVG error text.

host=popeyeOtherEye does not exist i assume

   index=_internal host=popeyeOtherEye
    | stats count 
    | eval KOLOR = case( count > 0,"limegreen",count ==0,"RED" ,true(),"orange")
    |eval svg_viz = "<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"no\"?>
    <!DOCTYPE svg PUBLIC \"-//W3C//DTD SVG 1.1//EN\" \"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd\">
    <svg viewBox=\"0 0 1200 250\" width=\"1200\" height=\"250\">
       <style>
         .small { font: bold  11px Calibri; }
        .heavy { font: bold 20px Calibri; }
      </style>   

      <rect x=\"0\" y=\"20\" rx=\"3\" ry=\"3\" width=\"90\" height=\"40\" style=\"fill:"+KOLOR+";stroke:black;stroke-width:2;opacity:1.0\" /> 

      <text x=\"10\" y=\"50\" fill=\"black\" style=\"opacity:0.8\"   class=\"heavy\"  >"+count+"</text>
      <text x=\"0\" y=\"75\" fill=\"black\" style=\"opacity:0.8\"  class=\"small\" >_internal Count</text>

    </svg> 
    "

[stanwin · Accepted solution]

Posting this to help anyone that has similar issues.

Although you probably would do this for even non svg vizualizations!

use an eval with coalesce or whatever you prefer to set default catch all value for all the tokens passed to the svg viz xml..

index=_internal 
| stats count 
| eval count = coalesce(count,"0")
| eval KOLOR = case( count > 0,"limegreen",count ==0,"RED" ,true(),"orange")

[msivill_splunk]

Version 3.0.1 of the Scalable Vector Graphics - Custom Visualization app has been updated to show different error messages.

• If there are no events from the query results then
  the standard "No results found" will
  be returned
• Errors with the svg_viz
  field not appearing in the query results or not having a value will return "SVG field error"
• Errors with bad SVG in
  svg_viz filed will return "SVG parse
  error"

While this does not solve the original issue it should help narrow down any potential issues quicker by identifying where the error may be.

[msivill_splunk]

Good catch and workaround.

I'll need to dig into how to fix this the next time I get to look at the code behind the SVG app.