Archive

What would stop a table from being visualised

New Member

Hi,

I have a table of values vs time and all I want to do is visualise it. But when I select the visualise tab all I get is a blank chart with no data-points.

Previously I have had no issues visualising tables this way. Anyone got any thoughts about what could be wrong?

More detail:

Search String (made generic): source=mysource "A -> B" | rex "processing time(ns):(?[^d]+)ns" | chart values(proc_time) as "Processing Time" by _time

This WORKS but the chart has no data points, despite the statistics table being fully populated with values in two columns.

As does:

Search String (made generic): source=mysource "A -> B" | rex "processing time(ns):(?[^d]+)ns" | table time proctime

This produces a full table of data also, but again, the visualisation of that table yields a blank chart.

The problem is definitely related to the EXTRACTED field. If I test using fields splunk has extracted it works. So somehow whatever that regular expression returns messes up the chart rendering (?)

Thanks,
James

Tags (1)
0 Karma

Motivator

try with timechart command
ex:

 source=mysource "A -> B" | rex "processing time(ns):(?[^d]+)ns" | timechart values(proc_time) as "Processing Time"
0 Karma

Motivator

Hi andrews_jg
You can use Statistics tab to see your results

0 Karma

New Member

Yes I can see the results, but I want to visualise them as a chart.

Thanks,
James

0 Karma

Esteemed Legend

What is the search that generates the table? What is the search that used to work? What is on the statistics tab?

0 Karma

New Member

Hi,

The query is a simple extraction that pulls a value out of the data.

The stats tab shows the correctly formatted table. 2 columns with a timestamp and the data.

Thanks,
James

0 Karma

Esteemed Legend

If you cannot be more specific, I do not see how anybody will be able to help you. As you have (too vaguely) described it, it should work just fine (and does for me). Therefore there must be something specifically wrong with your specific search, which you have chosen not to disclose.

0 Karma

New Member

Ok...

No I haven't chosen not to disclose something... I was not intending to be vague, just keep the question simple. I was hoping someone might have seen these GENERAL symptoms before and could advise.

Its the opposite of what you said, the problem in this case is GENERALLY happening to every search that yields a nice table of results.

But to satisfy the curious here is some more detail:

Search String (made generic): source=mysource "A -> B" | rex "processing time(ns):(?[^d]+)ns" | chart values(proc_time) as "Processing Time" by _time

This WORKS but the chart has no data points, despite the statistics table being fully populated with values in two columns.

As does:

Search String (made generic): source=mysource "A -> B" | rex "processing time(ns):(?[^d]+)ns" | table time proctime

This produces a full table of data also, but again, the visualisation of that table yields a blank chart.

Other searches do the same. I get nice tables of data, but visualisations fail to render.

The same is true of ANY table I produce. So to restate my original (simple) question, are there any known (or other users seen similar) issues or traps that prevent a table being visualised? i.e. config issues, GUI bugs etc?

I have done this many times in the past, but it seems to not be working any more.

Thanks,
James

0 Karma

New Member

one more thing... To be clear, the searches that used work (visualisation of tables worked) were on a different Splunk instance. Hence my comment about config or GUI bugs.

I can no longer test this on the old instance. But I will attempt to replicate on a fresh install to see if it is specific to the instance I am using.

Thanks,
James

0 Karma

Esteemed Legend

Are you running your search in verbose mode (under the timepicker)? It should not matter but that is the only thing I can think to try. Otherwise open a support case because it sounds like a bug to me.

0 Karma

New Member

Yes I am using verbose mode. I will do some more digging and raise a support case if I can't find anything further

0 Karma