I have a drilldown set up in a panel on a dashboard, and it's not returning any results.
I have tested the underlying search, and it returns results as I would like. For some reason, the view shows that the search is being executed, but no results are appearing. Am I doing something wrong?
<module name="HiddenPostProcess" layoutPanel="panel_row1_col1" group="Longest Time to Level(Based on Median)" autoRun="False"> <param name="search">fields "Level Reached", "Median Time to Level"</param> <param name="groupLabel">Longest Time to Level(Based on Median)</param> <module name="ViewstateAdapter"> <module name="HiddenFieldPicker"> <param name="strictMode">True</param> <module name="JobProgressIndicator"> <module name="EnablePreview"> <param name="enable">True</param> <param name="display">False</param> <module name="HiddenChartFormatter"> <param name="charting.secondaryAxisTitle.text">Minutes</param> <param name="charting.chart">bar</param> <module name="FlashChart"> <param name="width">100%</param> <module name="HiddenSearch"> <param name="search">index=zos_gameplay event_type=level source_player_level=$token$ | table source_player_id, played_time</param> <param name="earliest">-7d</param> <module name="ConvertToIntention"> <param name="intention"> <param name="name">stringreplace</param> <param name="arg"> <param name="token"> <param name="value">$click.value$</param> </param> </param> </param> <module name="JobProgressIndicator"></module> <module name="SimpleResultsHeader"> <param name="entityName">results</param> <param name="headerFormat">Top 10 Fastest Levelers for Level $click.value$</param> </module> <module name="HiddenChartFormatter"> <param name="chart">bar</param> <param name="primaryAxisTitle.text">Character Name</param> <param name="secondaryAxisTitle.text">minutes</param> <param name="legend.placement">none</param> <module name="FlashChart"> <param name="width">100%</param> <param name="height">160px</param> </module> </module> </module> </module> </module> </module> </module> </module> </module> </module> </module>
Is it that first chart that's not rendering any results, or is that chart working fine and it's the second FlashChart module that isn't working? If it's the first chart the problem is probably that the base search doesn't use those two fields in the HiddenPostProcess. (on the same topic there's not much reason to have a postProcess search that only does a single fields clause...). Anyway, it sounds like the second FlashChart is the one with the problem but I wanted to double check that before answering.
Sorry for the late response.
The first chart is merely narrowing the results of the original search for displaying a more generalized data set, which is expanded in another panel later in the dashboard.
The second chart is the problem. After clicking on a bar from the first chart, the second search seems to execute, but no results show up. However, when I run the search on it's own, it returns a multitude of results.
Well I don't see any problem with your stringreplace syntax.
My suggestion is to get yourself set up so you can see exactly what search it is running.
1) use Firebug to see the HTTP traffic.
a) Open Firefox,
b) find and install the Firebug plugin for Firefox,
c) after restarting Firefox, open Firebug by clicking the little bug icon in the bottom right edge of the Firefox window
d) Enable Firebug's "Net" tab.
e) reload the Splunk view with Firebug open, and in firebug's NET tab, you'll see some POST requests to the jobs endpoint.
f) find the correct POST to the jobs endpoint that represents your drilldown click, and open the little 'params' tab within that request.
In there you'll see exactly what search and timerange was sent to the server, and I suspect there's some unexpected difference that you'll see there.
2) Temporarily throw a $search$ into your SimpleResultsHeader module.
This is a strange trick, but $search$ always refers to the search language operating at that point in the module hierarchy. So you can trick SimpleResultsHeader into dumping out the search, complete with the parsed stringreplace intention.
3) stringreplace is clunky and brittle. In the long run you may be better off switching to Sideview Utils. This view would be pretty similar after the switch but the main difference would be the absence of any ConvertToIntention modules; Sideview Utils basically allows you to plug tokens like $click.value$ directly into the search string. And there are a ton of other things that are greatly improved by using Sideview Utils - proper linking to other views and having the form elements there prepopulate from URL args, using whatever HTML you like, etc.. Too many things to mention here but taken together they'll greatly improve your quality of life as a Splunk developer. (as the owner of Sideview Utils I'm perhaps a little biased, but not much)
One more thought is that it's possible that your view has no "Message" module. When this happens, very useful error messages can end up being hidden from the view's developer, simply because the Message module is the only way certain kinds of errors can be seen. Make sure to always have at least one Message module in every view.
UPDATE: the problem may simply be that the postProcess you're using at the top, gets applied to the second level search and thus the chart as well. This is a common source of confusion. If you were using Sideview Utils, it has tons of little improvements and one of those (as of Sideview Utils version 2.2.7) is that the PostProcess module's argument gets automatically cleared so it wont leak down to lower drilldown searches and cause confusion.
If this is the root cause, the workaround (besides switching to Sideview Utils and using the PostProcess module instead of HiddenPostProcess) is to stitch in the following module just upstream from the second FlashChart
<module name="HiddenPostProcess"> <param name="search"> </param>
which will explicitly clear the postprocess search.
It's sending out the correct search, apparently. Both Firebug and the $search$ tag agree.
the timerange being sent out is -7d, just like I specified.
But there are no results on the dashboard.
and there actually is a message module, it's just at the beginning of the XML of the dashboard, which I have cut shorter for company privacy. It mostly contained a couple dropdowns and a timerange picker, along with another panel for the dashboard below this one.
Interesting. I wonder if it's purely a rendering problem in the FlashChart. I know that the upstream FlashChart is fine, but it's possible the lower one is getting hung up. Can you throw another SimpleResultsTable module in there as sibling of your HiddenChartFormatter (or as a sibling of the FlashChart, it wont matter). If it's purely a rendering problem with that particular Flash movie in that particular layout, then the results will show up fine in the table.
I took another look at your posted XML and I see the problem. I have added an update to my answer . the problem is that the HiddenPostProcess module lets its postprocess search argument leak down to drilldown searches, so the fields clause is being applied erroneously to the drilldown report's search, and you end up with no fields to graph.
I have been having the same issue. I found if i change the layout position of the 2nd chart it fixes the problem but it breaks the layout. For example if my first chart is row1col1 then chart 2 is blank. if i change chart 2 to row2col1 or row1_col2 or leave it with no layout position it is still blank. If I change chart 1 to row2 and chart 2 to row1 then it is no longer blank. I think this is a bug but I cannot seem to get any one from Splunk to look into the issue or respond.
Same comment I asked atreece - to troubleshoot can you put SimpleResultsTable modules in there instead of the chart? I suspect that it's a rendering problem specific to just the chart module and it would help to narrow that down. Also is this FlashChart or JSChart you're using? Between the CSS in the FlashChart and CSS in the dashboard template and the flash-rendering itself I have seen several bugs where FlashCharts fail to render.
The issue is specific to flashcharts. I can see the results have populated as the card gets larger but its plain white. If i use tables or any other option I am able to see the results. I have even used UIs from the UI example package and replaced the tables with charts and again it breaks.