Dashboards & Visualizations

Chart not plotting in dashboard

RNB
Path Finder

I am using Splunk 4.2.1, build 98164. I am creating simple multi-panel dashboards and not all charts in the dashboard are being plotted. For example, one dashboard uses two graphs and one event_viewer. The graph that does not plot uses the same saved search as the event_viewer panel, and of course there is lots of data returned in the event_viewer panel. Therefore, there should be lots of data points for the graph to plot.

This is not the only dashboard I am experiencing this issue with, and clicking on "View results" displays search results that should be plotted. I am also observing that some panels plot data intermittently, where sometimes I will see plotted graphs for a while, and then for a majority of the time, the graph will be blank, not plotted when there are search results that should be plotted.

I am experiencing this issue in both InterNet Explorer 9 and Firefox 3.6.16. Any ideas?

<?xml version='1.0' encoding='utf-8'?>




Ticket 39219
PCI Zone to 192.168.153.59


Dashboard - Drop Rate Exceeded
Drop Rate Exceeded
all




Ticket 39219
Details


Additional information:

I have moved the charts so they are no longer side by side, one is on top of the other. The chart that is not displaying results actually plots and you can see the results for a fraction of a second before the chart becomes becomes blank. The second chart continues to display the plotted data.

Search strings after the colon:

Ticket 39219: (192.168.153.59 NOT (search))

Dashboard - Drop Rate Exceeded: ( "drop rate" NOT ("search"))

Nick put me on to something:

For the chart panel, I replaced the saved search to an inline search that used the string:

(192.168.153.59 NOT (search)) | timechart count

This is producing a plotted chart consistently so far. Now the other chart is not plotting, but I will use the same method.

Tags (3)
1 Solution

Paolo_Prigione
Builder

Hi RNB,
some things I've noticed:

  1. Any Splunk chart expects data in a specific format, which is specified in the Charting Reference page. A <chart> panel won't generally plot a list of events, as nick noted. You should have a command such as stats or timechart to prepare data for plotting. Maybe this is the reason why you don't get any chart.

  2. In case you have missing data points and you are using line or area charts, splunk will not show you those points in a line chart. You've got to tell it how to deal with those gaps, which is the following option: <option name="charting.nullValueMode">(accepted values: gaps, zero, and connect)</option>, to be put between the <chart> and </chart> tags.

  3. If possible, add markes to line charts in oder to visualize data points which are not connected to anything else: <option name="charting.showMarkers
    ">true</option>

As a personal suggestion, try to manually run your saved search and see whether, on the rightmost part of the screen over the list of returned events/results, you have a "show report" or "build report" button:

  • the former means your data can aleady be plotted: open the report viewer and play with the settings at wish
  • the latter means your data is not yet suitable for charting, so you will need some repoting command (top, stats, timechart,... therefore to post process the search results)

Cheers!
Paolo

View solution in original post

giovere
Path Finder

If charting.nullValueMode does not work for you try:

<option name="charting.chart.nullValueMode">value...</option>
0 Karma

Paolo_Prigione
Builder

Hi RNB,
some things I've noticed:

  1. Any Splunk chart expects data in a specific format, which is specified in the Charting Reference page. A <chart> panel won't generally plot a list of events, as nick noted. You should have a command such as stats or timechart to prepare data for plotting. Maybe this is the reason why you don't get any chart.

  2. In case you have missing data points and you are using line or area charts, splunk will not show you those points in a line chart. You've got to tell it how to deal with those gaps, which is the following option: <option name="charting.nullValueMode">(accepted values: gaps, zero, and connect)</option>, to be put between the <chart> and </chart> tags.

  3. If possible, add markes to line charts in oder to visualize data points which are not connected to anything else: <option name="charting.showMarkers
    ">true</option>

As a personal suggestion, try to manually run your saved search and see whether, on the rightmost part of the screen over the list of returned events/results, you have a "show report" or "build report" button:

  • the former means your data can aleady be plotted: open the report viewer and play with the settings at wish
  • the latter means your data is not yet suitable for charting, so you will need some repoting command (top, stats, timechart,... therefore to post process the search results)

Cheers!
Paolo

RNB
Path Finder

I have changed the searches from saved searches to inline searches. This was done to test the modified searches without modifying the saved searches. I have added "| timechart count" to the inline search strings and I am getting the desired results consistently.

0 Karma

sideview
SplunkTrust
SplunkTrust

Can you post the actual search language of the "Ticket 39219" search as well? In general searches that return events and do not have another command in them like 'stats' or 'timechart' are not directly chartable in the Flash Chart.

0 Karma

RNB
Path Finder

<?xml version='1.0' encoding='utf-8'?>




Ticket 39219
PCI Zone to 192.168.153.59


Dashboard - Drop Rate Exceeded
Drop Rate Exceeded
all




Ticket 39219
Details


The panel "Ticket 39219" is the panel that is most often blank.

0 Karma

RicoSuave
Builder

Can you please post the xml for your dashboard? i ran into similar issues with 4.2 and found a bug where single value modules won't render when combined in the same panel as another chart.

0 Karma
Get Updates on the Splunk Community!

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...