Dashboards & Visualizations

Drilldown not returning results

atreece
Path Finder

I have a drilldown set up in a panel on a dashboard, and it's not returning any results.
I have tested the underlying search, and it returns results as I would like. For some reason, the view shows that the search is being executed, but no results are appearing. Am I doing something wrong?

the code:

<module name="HiddenPostProcess" layoutPanel="panel_row1_col1" group="Longest Time to Level(Based on Median)" autoRun="False">
  <param name="search">fields "Level Reached", "Median Time to Level"</param>
  <param name="groupLabel">Longest Time to Level(Based on Median)</param>
  <module name="ViewstateAdapter">
    <module name="HiddenFieldPicker">
      <param name="strictMode">True</param>
      <module name="JobProgressIndicator">
        <module name="EnablePreview">
          <param name="enable">True</param>
          <param name="display">False</param>
          <module name="HiddenChartFormatter">
            <param name="charting.secondaryAxisTitle.text">Minutes</param>
            <param name="charting.chart">bar</param>
            <module name="FlashChart">
              <param name="width">100%</param>
              <module name="HiddenSearch">
                <param name="search">index=zos_gameplay event_type=level source_player_level=$token$ | table source_player_id, played_time</param>
                <param name="earliest">-7d</param>
                <module name="ConvertToIntention">
                  <param name="intention">
                    <param name="name">stringreplace</param>
                    <param name="arg">
                      <param name="token">
                        <param name="value">$click.value$</param>
                      </param>
                    </param>
                  </param>
                  <module name="JobProgressIndicator"></module>
                  <module name="SimpleResultsHeader">
                    <param name="entityName">results</param>
                    <param name="headerFormat">Top 10 Fastest Levelers for Level $click.value$</param>
                  </module> 
                  <module name="HiddenChartFormatter">
                    <param name="chart">bar</param>
                    <param name="primaryAxisTitle.text">Character Name</param>
                    <param name="secondaryAxisTitle.text">minutes</param>
                    <param name="legend.placement">none</param>
                    <module name="FlashChart">
                      <param name="width">100%</param>
                      <param name="height">160px</param>
                    </module>
                  </module>
                </module>
              </module>
            </module>
          </module>
        </module>
      </module>
    </module>
  </module>
</module>
Tags (1)

sburkit
New Member

I have been having the same issue. I found if i change the layout position of the 2nd chart it fixes the problem but it breaks the layout. For example if my first chart is row1_col1 then chart 2 is blank. if i change chart 2 to row2_col1 or row1_col2 or leave it with no layout position it is still blank. If I change chart 1 to row2 and chart 2 to row1 then it is no longer blank. I think this is a bug but I cannot seem to get any one from Splunk to look into the issue or respond.

0 Karma

sburkit
New Member

Still the same issue. You can use the Advanced UI examples or this page http://docs.splunk.com/Documentation/Splunk/5.0.2/AdvancedDev/TableChartDrilldown and see even these examples have the same issue. So I would guess it has something to do with the splunk core not a user ended problem.

0 Karma

sideview
SplunkTrust
SplunkTrust

Difficult to say. It's a little brutal, but I would throw this into your application.css file (and then clear browser cache to pick up the new css) to see if it helps.

If your view name is "my_view_name", then do

.splView-my_view_name .FlashChart {
    position:relative;
    clear:both;
}
0 Karma

sburkit
New Member

The issue is specific to flashcharts. I can see the results have populated as the card gets larger but its plain white. If i use tables or any other option I am able to see the results. I have even used UIs from the UI example package and replaced the tables with charts and again it breaks.

0 Karma

sideview
SplunkTrust
SplunkTrust

Same comment I asked atreece - to troubleshoot can you put SimpleResultsTable modules in there instead of the chart? I suspect that it's a rendering problem specific to just the chart module and it would help to narrow that down. Also is this FlashChart or JSChart you're using? Between the CSS in the FlashChart and CSS in the dashboard template and the flash-rendering itself I have seen several bugs where FlashCharts fail to render.

0 Karma

sideview
SplunkTrust
SplunkTrust

Well I don't see any problem with your stringreplace syntax.

My suggestion is to get yourself set up so you can see exactly what search it is running.

1) use Firebug to see the HTTP traffic.
a) Open Firefox,

b) find and install the Firebug plugin for Firefox,

c) after restarting Firefox, open Firebug by clicking the little bug icon in the bottom right edge of the Firefox window
d) Enable Firebug's "Net" tab.
e) reload the Splunk view with Firebug open, and in firebug's NET tab, you'll see some POST requests to the jobs endpoint.
f) find the correct POST to the jobs endpoint that represents your drilldown click, and open the little 'params' tab within that request.

In there you'll see exactly what search and timerange was sent to the server, and I suspect there's some unexpected difference that you'll see there.

2) Temporarily throw a $search$ into your SimpleResultsHeader module.

This is a strange trick, but $search$ always refers to the search language operating at that point in the module hierarchy. So you can trick SimpleResultsHeader into dumping out the search, complete with the parsed stringreplace intention.

3) stringreplace is clunky and brittle. In the long run you may be better off switching to Sideview Utils. This view would be pretty similar after the switch but the main difference would be the absence of any ConvertToIntention modules; Sideview Utils basically allows you to plug tokens like $click.value$ directly into the search string. And there are a ton of other things that are greatly improved by using Sideview Utils - proper linking to other views and having the form elements there prepopulate from URL args, using whatever HTML you like, etc.. Too many things to mention here but taken together they'll greatly improve your quality of life as a Splunk developer. (as the owner of Sideview Utils I'm perhaps a little biased, but not much)

One more thought is that it's possible that your view has no "Message" module. When this happens, very useful error messages can end up being hidden from the view's developer, simply because the Message module is the only way certain kinds of errors can be seen. Make sure to always have at least one Message module in every view.

UPDATE: the problem may simply be that the postProcess you're using at the top, gets applied to the second level search and thus the chart as well. This is a common source of confusion. If you were using Sideview Utils, it has tons of little improvements and one of those (as of Sideview Utils version 2.2.7) is that the PostProcess module's argument gets automatically cleared so it wont leak down to lower drilldown searches and cause confusion.

If this is the root cause, the workaround (besides switching to Sideview Utils and using the PostProcess module instead of HiddenPostProcess) is to stitch in the following module just upstream from the second FlashChart

<module name="HiddenPostProcess">
  <param name="search"> </param>

which will explicitly clear the postprocess search.

sideview
SplunkTrust
SplunkTrust

I took another look at your posted XML and I see the problem. I have added an update to my answer . the problem is that the HiddenPostProcess module lets its postprocess search argument leak down to drilldown searches, so the fields clause is being applied erroneously to the drilldown report's search, and you end up with no fields to graph.

0 Karma

sideview
SplunkTrust
SplunkTrust

Interesting. I wonder if it's purely a rendering problem in the FlashChart. I know that the upstream FlashChart is fine, but it's possible the lower one is getting hung up. Can you throw another SimpleResultsTable module in there as sibling of your HiddenChartFormatter (or as a sibling of the FlashChart, it wont matter). If it's purely a rendering problem with that particular Flash movie in that particular layout, then the results will show up fine in the table.

0 Karma

atreece
Path Finder

It's sending out the correct search, apparently. Both Firebug and the $search$ tag agree.
the timerange being sent out is -7d, just like I specified.

But there are no results on the dashboard.

and there actually is a message module, it's just at the beginning of the XML of the dashboard, which I have cut shorter for company privacy. It mostly contained a couple dropdowns and a timerange picker, along with another panel for the dashboard below this one.

0 Karma

atreece
Path Finder

Sorry for the late response.
The first chart is merely narrowing the results of the original search for displaying a more generalized data set, which is expanded in another panel later in the dashboard.
The second chart is the problem. After clicking on a bar from the first chart, the second search seems to execute, but no results show up. However, when I run the search on it's own, it returns a multitude of results.

0 Karma

sideview
SplunkTrust
SplunkTrust

Is it that first chart that's not rendering any results, or is that chart working fine and it's the second FlashChart module that isn't working? If it's the first chart the problem is probably that the base search doesn't use those two fields in the HiddenPostProcess. (on the same topic there's not much reason to have a postProcess search that only does a single fields clause...). Anyway, it sounds like the second FlashChart is the one with the problem but I wanted to double check that before answering.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...