Dashboards & Visualizations

: NULL in legend

ctallarico20
Path Finder

Hi, I'm wondering why the search "RESULTS"| timechart span=1d sum(SUCCESS) as "Successes" sum(FAILURE) as "Failures" by RESULTS displays a : NULL in the legend. For example, my legend reads SUCCESSES: NULL and FAILURES: NULL although the data is displayed correctly/ I think this has something to do with the fact that my logs don't always have both a success and fail count, it's usually one or the other.

Tags (3)
0 Karma
1 Solution

Gilberto_Castil
Splunk Employee
Splunk Employee

Thanks for posting the sample data. I can replicate the condition you describe. The culprit is the "by RESULTS" clause because it is trying to group the results by the field RESULTS. Try this:

"RESULTS"| timechart span=1d sum(SUCCESS) as "Successes" sum(FAILURE) as "Failures"

View solution in original post

ctallarico20
Path Finder

you got it! thank you so much!

0 Karma

Gilberto_Castil
Splunk Employee
Splunk Employee

Thanks for posting the sample data. I can replicate the condition you describe. The culprit is the "by RESULTS" clause because it is trying to group the results by the field RESULTS. Try this:

"RESULTS"| timechart span=1d sum(SUCCESS) as "Successes" sum(FAILURE) as "Failures"

ctallarico20
Path Finder

[2013-06-03 11:38:40:66 EDT] RESULTS FAILURE=5
[2013-06-03 11:38:40:66 EDT] RESULTS SUCCESS=15

0 Karma

Gilberto_Castil
Splunk Employee
Splunk Employee

This points to the data extraction not having the right context. Would you be able to quote two or three lines from the tabular display?

ctallarico20
Path Finder

I appreciate the help, but I believe this only filters the result "NULL" from the timechart. I have the suffix ": NULL" added to all of my data

0 Karma

Gilberto_Castil
Splunk Employee
Splunk Employee

The timechart command has an optional flag to avoid NULL values. Try this:

 ... "RESULTS" | timechart span=1d sum(SUCCESS) as "Successes" sum(FAILURE) as "Failures" by RESULTS usenull=false

gc

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...