Dashboards & Visualizations

Events and results returned from search, results not charted correctly

milestulett
Path Finder

Hi,

I have a search that runs to extract garbage collection times from some JVM logs:

sourcetype="WLE_GC_Logs" | rex field=_raw "totalms=\"(?[0-9]+.[0-9]+)\" />[\r|\n|\r\n]" | anomalies field=GCTime threshold=0.04 | xyseries _time host GCTime

This searches the logs, extracts the garbage collection time using regex, then finds the anomalies that have occurred and is then supposed to plot them.

-

The problem occurs during the plotting - while the search is running, I can see the report graph being generated, however, as soon as the search finishes, then graph disappears and I'm left with "No results found. Inspect.."

Clicking through gives me the following:

================================

This search has completed and found 5 matching events. However, the transforming commands in the highlighted portion of the following search:

search sourcetype="WLE_GC_Logs" | rex field=_raw "totalms=\"(?[0-9]+.[0-9]+)\" />[\r|\n|\r\n]" | anomalies field=GCTime threshold=0.04 | xyseries _time host GCTime
over the time range:

06/01/2012 16:34:51.000 – (latest indexed event)
generated no results. Possible solutions are to:

check the syntax of the commands
verify that the fields expected by the report commands are present in the events
The following messages were returned by the search subsystem:

DEBUG: base lispy: [ AND sourcetype::wle_gc_logs ]
DEBUG: search context: user="admin", app="search", bs-pathname="C:\Program Files\Splunk\etc"
Learn more about troubleshooting empty search results at Splunk Documentation.

================================

What puzzles me is that it plots the graph completely fine for a while, then switches to "No results found". If I pause the search while the graph still looks ok, then there's no problem and I see exactly what is intended.

Any ideas anyone? Bug in the new graphing engine? Splunk version is 4.3

Thanks for any help 🙂

Cheers,
Miles

**EDIT:

So I've found that when I strip off the xyseries section from the end, all the results are returned correctly, which leads me to believe that the xyseries command is doing something funny with the results.

Has anyone encountered any problems graphing results with xyseries?

After some more playing round, I'm fairly certain it's xyseries. I've opened a support case with Splunk - I'll report back with the results.

Tags (2)
0 Karma
1 Solution

milestulett
Path Finder

I submitted a case with support (enterprise support is useful) - The support guys have replicated my problem and raised it as a bug, it turns out there was a problem with xyseries after all. Bug #SPL-47278.

Hopefully this will be fixed in the near future as part of a release.

Thanks all.

View solution in original post

milestulett
Path Finder

I submitted a case with support (enterprise support is useful) - The support guys have replicated my problem and raised it as a bug, it turns out there was a problem with xyseries after all. Bug #SPL-47278.

Hopefully this will be fixed in the near future as part of a release.

Thanks all.

Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...