Dashboards & Visualizations

Events and results returned from search, results not charted correctly

milestulett
Path Finder

Hi,

I have a search that runs to extract garbage collection times from some JVM logs:

sourcetype="WLE_GC_Logs" | rex field=_raw "totalms=\"(?[0-9]+.[0-9]+)\" />[\r|\n|\r\n]" | anomalies field=GCTime threshold=0.04 | xyseries _time host GCTime

This searches the logs, extracts the garbage collection time using regex, then finds the anomalies that have occurred and is then supposed to plot them.

-

The problem occurs during the plotting - while the search is running, I can see the report graph being generated, however, as soon as the search finishes, then graph disappears and I'm left with "No results found. Inspect.."

Clicking through gives me the following:

================================

This search has completed and found 5 matching events. However, the transforming commands in the highlighted portion of the following search:

search sourcetype="WLE_GC_Logs" | rex field=_raw "totalms=\"(?[0-9]+.[0-9]+)\" />[\r|\n|\r\n]" | anomalies field=GCTime threshold=0.04 | xyseries _time host GCTime
over the time range:

06/01/2012 16:34:51.000 – (latest indexed event)
generated no results. Possible solutions are to:

check the syntax of the commands
verify that the fields expected by the report commands are present in the events
The following messages were returned by the search subsystem:

DEBUG: base lispy: [ AND sourcetype::wle_gc_logs ]
DEBUG: search context: user="admin", app="search", bs-pathname="C:\Program Files\Splunk\etc"
Learn more about troubleshooting empty search results at Splunk Documentation.

================================

What puzzles me is that it plots the graph completely fine for a while, then switches to "No results found". If I pause the search while the graph still looks ok, then there's no problem and I see exactly what is intended.

Any ideas anyone? Bug in the new graphing engine? Splunk version is 4.3

Thanks for any help 🙂

Cheers,
Miles

**EDIT:

So I've found that when I strip off the xyseries section from the end, all the results are returned correctly, which leads me to believe that the xyseries command is doing something funny with the results.

Has anyone encountered any problems graphing results with xyseries?

After some more playing round, I'm fairly certain it's xyseries. I've opened a support case with Splunk - I'll report back with the results.

Tags (2)
0 Karma
1 Solution

milestulett
Path Finder

I submitted a case with support (enterprise support is useful) - The support guys have replicated my problem and raised it as a bug, it turns out there was a problem with xyseries after all. Bug #SPL-47278.

Hopefully this will be fixed in the near future as part of a release.

Thanks all.

View solution in original post

milestulett
Path Finder

I submitted a case with support (enterprise support is useful) - The support guys have replicated my problem and raised it as a bug, it turns out there was a problem with xyseries after all. Bug #SPL-47278.

Hopefully this will be fixed in the near future as part of a release.

Thanks all.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...