Dashboards & Visualizations
Highlighted

: NULL in legend

Path Finder

Hi, I'm wondering why the search "RESULTS"| timechart span=1d sum(SUCCESS) as "Successes" sum(FAILURE) as "Failures" by RESULTS displays a : NULL in the legend. For example, my legend reads SUCCESSES: NULL and FAILURES: NULL although the data is displayed correctly/ I think this has something to do with the fact that my logs don't always have both a success and fail count, it's usually one or the other.

Tags (3)
0 Karma
Highlighted

Re: : NULL in legend

Splunk Employee
Splunk Employee

The timechart command has an optional flag to avoid NULL values. Try this:

 ... "RESULTS" | timechart span=1d sum(SUCCESS) as "Successes" sum(FAILURE) as "Failures" by RESULTS usenull=false

gc

0 Karma
Highlighted

Re: : NULL in legend

Path Finder

I appreciate the help, but I believe this only filters the result "NULL" from the timechart. I have the suffix ": NULL" added to all of my data

0 Karma
Highlighted

Re: : NULL in legend

Splunk Employee
Splunk Employee

This points to the data extraction not having the right context. Would you be able to quote two or three lines from the tabular display?

Highlighted

Re: : NULL in legend

Path Finder

[2013-06-03 11:38:40:66 EDT] RESULTS FAILURE=5
[2013-06-03 11:38:40:66 EDT] RESULTS SUCCESS=15

0 Karma
Highlighted

Re: : NULL in legend

Splunk Employee
Splunk Employee

Thanks for posting the sample data. I can replicate the condition you describe. The culprit is the "by RESULTS" clause because it is trying to group the results by the field RESULTS. Try this:

"RESULTS"| timechart span=1d sum(SUCCESS) as "Successes" sum(FAILURE) as "Failures"

View solution in original post

Highlighted

Re: : NULL in legend

Path Finder

you got it! thank you so much!

0 Karma