All Apps and Add-ons

[Sideview Utils] JSChart/ FlashChart doesn't show any results

guilhem
Contributor

Hello!

I am still playing with the sideview utils framework and I've come accross a strange problem. I have a search that is running and taking values from upstream pulldowns & other modules. The search is executed, but the results of the search doesn't show up in the downstream JSChart module, but the chart appears (I mean the axis and the values of the axis)

Here's what I have checked:
1°) When I put a SimpleResultsTable as a downstream module of the search, the value displayed are only the ones sets by the upstream ResultValueSetter (nothing from the search appears inside the table)
2°) When I put a CustomResultsTable as a downstream module of the search, the results of the search is displayed (there is only one row of results of the search), so it seems that the search is done.
3°) I have put an HTML module for debugging purpose as a downstream module and the $search$ variable gives me a valid search, if ran in the core app of splunk the search return a valid result.
4°) When running the search in the core search app, I get a valid results, and if I toggle to the chart view, it gives me a chart where the results are displayed.
5°) I've tried to replace the HiddenChartFormatter + JSChart by only the JSChart, or a FlashChart, but nothing is displayed inide the charts.
6°) I've tried to see the page using chrome/ firefox and safari, but nothing is displayed inside the charts.
7°) I have tried to put a button module before the search, because I was thinking that maybe the search was executed before the results from upstream modules returns (saw the autoRun problem in another topic), but it didn't change anything, when I click on the button, the search is done, but no results are displayed in the chart.
8°) I have tried to run another search that gives the same sort of results, but that returns several rows, but nothing is displayed either (I have seen in another topic that if there is only one row some charts display the results but they are not very visible (the line formatting for example)).

Another interesting thing is that I have another JSChart downstream the search and the exact same problem happens (the HTML display a valid search, but the chart is not populated with the search result)

I'm now kind of stucked, I don't see what more I can test to find the error.

Here is the piece of XML concerned:

http://pastebin.com/ghpr33YR

Any help would be greatly appreciated!

0 Karma
1 Solution

sideview
SplunkTrust
SplunkTrust

The problem is that PostProcess searches continue to be inherited and used by all the lower layers of module config.

So although you only wanted to use that PostProcess with ResultsValueSetter to pull down your $version$ key, what happens is that when the JSChart and FlashChart request the data, they too pass along the PostProcess.

I'm still considering a change to make the framework basically discard the postProcess search arguments right at (and below) the points where a new search gets dispatched. I may still do this, despite the fact that someone might have relied on this behavior.

Regardless, for now, simply stitch in this to basically reset that postProcess back to nothing:

<module name="PostProcess">
   <param name="search"> </param>

   ... your FlashChart/JSChart/SimpleResultsTable   goes here ... 

As to why the CustomResultsTable works, quite possibly whoever wrote that module didn't implement any postProcess support, so it's immune to this confusing side effect.

View solution in original post

batcave
Explorer

I don't have a PostProcess but my main search is a HiddenSavedSearch. Still no graphs - either JS or Flash

0 Karma

guilhem
Contributor

I was thinking in setting the downstream autorun to " " but I get the error:

ERROR - is not allowed as a value for autoRun. Set one of the allowed values - (True) or leave it blank.

0 Karma

guilhem
Contributor

I would love to, and I tried, but as long as I set the upstream pulldown autoRun to true, it seems that I cannot change the autoRun values in downstream module, I mean I can edit it in the sideview editor, but when I try to save the empty field, it defaults automatically to autoRun = true (I assume that it is because the null value in the autorun fields is defaulted to the herited one, because when I delete the autorun=true in the top pulldown upstream module, I can set what I want in the downstream autorun fields)

0 Karma

sideview
SplunkTrust
SplunkTrust

The problem is that PostProcess searches continue to be inherited and used by all the lower layers of module config.

So although you only wanted to use that PostProcess with ResultsValueSetter to pull down your $version$ key, what happens is that when the JSChart and FlashChart request the data, they too pass along the PostProcess.

I'm still considering a change to make the framework basically discard the postProcess search arguments right at (and below) the points where a new search gets dispatched. I may still do this, despite the fact that someone might have relied on this behavior.

Regardless, for now, simply stitch in this to basically reset that postProcess back to nothing:

<module name="PostProcess">
   <param name="search"> </param>

   ... your FlashChart/JSChart/SimpleResultsTable   goes here ... 

As to why the CustomResultsTable works, quite possibly whoever wrote that module didn't implement any postProcess support, so it's immune to this confusing side effect.

sideview
SplunkTrust
SplunkTrust

Note that as of Sideview Utils 2.2.7, this explicit clearing of the postProcess search for an inline drilldown situation, is no longer necessary. As of that release the underlying code has been patched so that when an inline drilldown (or any module configuration technically) results in a second layer of search arguments being dispatched as a second dispatched search, then and there the postProcess search from the earlier layer upstream, gets cleared out automatically. I think that at least current Sideview Utils users will then not see this class of bugs anymore.

0 Karma

guilhem
Contributor

Thanks you very very much for the answer, it totally solved my problem. Now I understand what happen , the postProcess module is applied all along the downstream modules (after the downstream searches), so I have to reset it by setting the search param to " ".

Thanks again for your quick answer, and the really nice app you got there.

0 Karma

sideview
SplunkTrust
SplunkTrust

One big warning -- you have more than one autoRun="True". This can cause a lot of very confusing problems, one of which is that one or more modules may suddenly show blank or incorrect results. You should only have the uppermost autoRun="True" and remove the lower ones. And regardless of your attempt with the Button module, remove the dangerous autoRun="True" attributes anyway.

Also, what is CustomResultsTable? It's definitely not a Sideview module. It's quite possible that this module is buggy and is generating a Javascript error that disrupts the rest of the modules' rendering.

0 Karma

guilhem
Contributor

A little more information, on the same page I have a saved search that is run in the viewHeader and displayed using a hiddenChartFormater + JSChart and the results are plotted. So it may not come from a displaying problem, I guess.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...