Can't get FlashChart to work on dashboard

[Branden]

I'm trying to build a dashboard that has a chart depicting our paging use over the past 24 hours. But instead of showing a chart, it just shows a big blank. I have a similar chart elsewhere on the dashboard that works just fine.

Here's my code:

<module name="HiddenSavedSearch" layoutPanel="panel_row3_col1" autoRun="True">
  <param name="savedSearch">Check Paging</param>
  <param name="useHistory">Auto</param>

  <module name="HiddenPostProcess" layoutPanel="panel_row3_col1_grp1">
     <param name="search">search host="xyz" | timechart avg(percent_used) by page_dev</param>

     <module name="HiddenChartFormatter">
        <param name="chart">line</param>
        <param name="primaryAxisTitle.text">Paging %</param>
        <param name="secondaryAxisTitle.text">Paging Device</param>
        <module name="FlashChart">
           <param name="width">100%</param>
           <param name="height">300px</param>
        </module>
     </module>
  </module>

I have verified that the Saved Search "Check Paging" is correct/valid, and runs every 5 minutes.

I tried it without 'search host="xyz"' but still no chart.

I was able to get this chart working in Simple XML, but without the HiddenSavedSearch.

Anyone have any idea what I'm doing wrong (preferably before I pull my hair out)?

Thanks!

[sideview]

UPDATE:

what is happening is that the underlying search does not refer to some of the fields that the postProcess search needs. And Splunk will only extract and collect the fields that are referred to in the base search. So one or more of host, percent_used, page_dev are undefined when it comes to the postProcess

The solution here is to refer to those fields somehow in the base search, often by tacking on a fields host, percent_used, page_dev. (developer note: you're using the REST API directly there's an arg called required_fields_list, and the UI often submits this arg to make things work out)

In this case however tacking the fields clause on will make the saved search behave oddly when it's run straight from the menu -- the presence of an explicit fields clause kind of pulls the rug out from under the FieldPicker module on the left and the interaction there ends up being confusing.

ORIGINAL ANSWER:

The XML looks fine.

A) One thing that bites people sometimes is that they remove the "Message" module from the page, and sometimes there's an informative error message that then becomes invisible. Like maybe there's a typo in the field names or something.

B) And if the main search is just a search for events, beware that postProcess only has access to the most recent 10,000 events. If your host doesnt appear in that top layer of events then your timechart wont have any data. The solution is to have the base search itself be a reporting search like " stats count by percent_used, page_dev, host", and adjust the math on the postProcess avg to account for when count>1. Search answers for postprocess or HiddenPostProcess to learn more.

some further questions:

1) Does the blank area have 'no results found' and a link that appears when you mouse over it?
a) if so - click the link and it'll give you more information about why the search had no results b) if there is no 'no results found', then this may be some css weirdness that's just causing it to not display. Is there any custom CSS going on here?

To troubleshoot I would try replacing the HiddenSavedSearch with a HiddenSearch that specifies the search and timerange manually.
And you can then troubleshoot the postProcess search by gluing it onto the end of your main search (adding in a pipe between them of course.)

[sideview]

That is definitely strange. maybe post the whole config as a separate question? With all the comments and updates we've both been doing, this one is getting a bit circuitous. 😃

[Branden]

Now this is weird... While testing, I created two charts. I got one of the charts working (see above). Cleaning up, I got rid of the second chart (blank). After that, the first chart stopped working. For kicks, I re-added the second chart and the first one started working again.
Doesn't that seem odd?

[Branden]

Got it! I added the fields to the Saved Search in the Manager and that did it!
Thanks so much!

[Branden]

Hmm...
Well, I modified my search to the following:
search host="xyz" | fields host, percent_used, page_dev | timechart avg(percent_used) by page_dev

Unfortunately, that did not solve the problem. I'm not sure how else to explicitly refer to the fields...

[sideview]

Oh man. I know what it us. I dont know how I missed it. I'll update my answer.

[Branden]

Okay I think I know what might be going on. In the Manager, I clicked on the saved search. I then clicked "view results". The results come up, but there are NO fields displayed on the left. But if I go to the search bar and press enter (running the search again), the fields appear.
Could this be the problem? If so, is this a bug?

[Branden]

Oh forgot to mention... no custom CSS here.

[Branden]

Thank you for your response.

The "Message" module is in place.
I don't think I'm anywhere close to the 10,000 event limit. I really don't index that much data.

The blank area is just blank. No "no results found" message or anything like that. Just a plain white box.
I did go ahead and replace "HiddenSavedSearch" with "HiddenSearch" and specified the time range manually. Unfortunately, I'm still getting the blank box.

This is very strange. I have a similar chart beneath it that works fine.

If you or anyone else has any others ideas, I'm all ears. Thanks!