Dashboards & Visualizations

Events and results returned from search, results not charted correctly

milestulett
Path Finder

Hi,

I have a search that runs to extract garbage collection times from some JVM logs:

sourcetype="WLE_GC_Logs" | rex field=_raw "totalms=\"(?[0-9]+.[0-9]+)\" />[\r|\n|\r\n]" | anomalies field=GCTime threshold=0.04 | xyseries _time host GCTime

This searches the logs, extracts the garbage collection time using regex, then finds the anomalies that have occurred and is then supposed to plot them.

-

The problem occurs during the plotting - while the search is running, I can see the report graph being generated, however, as soon as the search finishes, then graph disappears and I'm left with "No results found. Inspect.."

Clicking through gives me the following:

================================

This search has completed and found 5 matching events. However, the transforming commands in the highlighted portion of the following search:

search sourcetype="WLE_GC_Logs" | rex field=_raw "totalms=\"(?[0-9]+.[0-9]+)\" />[\r|\n|\r\n]" | anomalies field=GCTime threshold=0.04 | xyseries _time host GCTime
over the time range:

06/01/2012 16:34:51.000 – (latest indexed event)
generated no results. Possible solutions are to:

check the syntax of the commands
verify that the fields expected by the report commands are present in the events
The following messages were returned by the search subsystem:

DEBUG: base lispy: [ AND sourcetype::wle_gc_logs ]
DEBUG: search context: user="admin", app="search", bs-pathname="C:\Program Files\Splunk\etc"
Learn more about troubleshooting empty search results at Splunk Documentation.

================================

What puzzles me is that it plots the graph completely fine for a while, then switches to "No results found". If I pause the search while the graph still looks ok, then there's no problem and I see exactly what is intended.

Any ideas anyone? Bug in the new graphing engine? Splunk version is 4.3

Thanks for any help 🙂

Cheers,
Miles

**EDIT:

So I've found that when I strip off the xyseries section from the end, all the results are returned correctly, which leads me to believe that the xyseries command is doing something funny with the results.

Has anyone encountered any problems graphing results with xyseries?

After some more playing round, I'm fairly certain it's xyseries. I've opened a support case with Splunk - I'll report back with the results.

Tags (2)
0 Karma
1 Solution

milestulett
Path Finder

I submitted a case with support (enterprise support is useful) - The support guys have replicated my problem and raised it as a bug, it turns out there was a problem with xyseries after all. Bug #SPL-47278.

Hopefully this will be fixed in the near future as part of a release.

Thanks all.

View solution in original post

milestulett
Path Finder

I submitted a case with support (enterprise support is useful) - The support guys have replicated my problem and raised it as a bug, it turns out there was a problem with xyseries after all. Bug #SPL-47278.

Hopefully this will be fixed in the near future as part of a release.

Thanks all.

Get Updates on the Splunk Community!

Splunk is Nurturing Tomorrow’s Cybersecurity Leaders Today

Meet Carol Wright. She leads the Splunk Academic Alliance program at Splunk. The Splunk Academic Alliance ...

Part 2: A Guide to Maximizing Splunk IT Service Intelligence

Welcome to the second segment of our guide. In Part 1, we covered the essentials of getting started with ITSI ...

Part 1: A Guide to Maximizing Splunk IT Service Intelligence

As modern IT environments continue to grow in complexity and speed, the ability to efficiently manage and ...