Dashboards & Visualizations

: NULL in legend

ctallarico20
Path Finder

Hi, I'm wondering why the search "RESULTS"| timechart span=1d sum(SUCCESS) as "Successes" sum(FAILURE) as "Failures" by RESULTS displays a : NULL in the legend. For example, my legend reads SUCCESSES: NULL and FAILURES: NULL although the data is displayed correctly/ I think this has something to do with the fact that my logs don't always have both a success and fail count, it's usually one or the other.

Tags (3)
0 Karma
1 Solution

Gilberto_Castil
Splunk Employee
Splunk Employee

Thanks for posting the sample data. I can replicate the condition you describe. The culprit is the "by RESULTS" clause because it is trying to group the results by the field RESULTS. Try this:

"RESULTS"| timechart span=1d sum(SUCCESS) as "Successes" sum(FAILURE) as "Failures"

View solution in original post

ctallarico20
Path Finder

you got it! thank you so much!

0 Karma

Gilberto_Castil
Splunk Employee
Splunk Employee

Thanks for posting the sample data. I can replicate the condition you describe. The culprit is the "by RESULTS" clause because it is trying to group the results by the field RESULTS. Try this:

"RESULTS"| timechart span=1d sum(SUCCESS) as "Successes" sum(FAILURE) as "Failures"

ctallarico20
Path Finder

[2013-06-03 11:38:40:66 EDT] RESULTS FAILURE=5
[2013-06-03 11:38:40:66 EDT] RESULTS SUCCESS=15

0 Karma

Gilberto_Castil
Splunk Employee
Splunk Employee

This points to the data extraction not having the right context. Would you be able to quote two or three lines from the tabular display?

ctallarico20
Path Finder

I appreciate the help, but I believe this only filters the result "NULL" from the timechart. I have the suffix ": NULL" added to all of my data

0 Karma

Gilberto_Castil
Splunk Employee
Splunk Employee

The timechart command has an optional flag to avoid NULL values. Try this:

 ... "RESULTS" | timechart span=1d sum(SUCCESS) as "Successes" sum(FAILURE) as "Failures" by RESULTS usenull=false

gc

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...