No Result Found while adding panel to a dashboard

[Rao_KGY]

Hello Everyone, Recently I have come across a very strange issue while adding a panel query to a dashboard. Following query working very fine in search but as soon as I add it to dashboard  it says "No results found". Not sure why ?


index=app_pl  "com. thehartford.pl.model.exception. Csc ServiceException: null
at com.thehartford.pl. rest.UserProfileController.buildUserProfile"
| bin span=1h _time
I table *
I stats count as Failure by _time

[gcusello]

Hi @Rao_KGY ,

probably the issue is the one indicated by @ITWhisperer : are you sure to use the same time frame i both the panels?

In addition, in your search, you dont need the table command and you could use the timechart command (https://docs.splunk.com/Documentation/SCS/current/SearchReference/TimechartCommandUsage):

index=app_pl  "com. thehartford.pl.model.exception. Csc ServiceException: null
at com.thehartford.pl. rest.UserProfileController.buildUserProfile"
| timechart count AS Failure span=1h

Ciao.

Giuseppe

[Rao_KGY]

Hey @gcusello @ITWhisperer  Thanks for the information. JFYI I'm using same timeframe (i.e. 24Hrs ) for both the panel & span is also same 1hr. 
@gcusello as per your suggestion I tried "timechart" but again same issue, "NO Result Found". But same query is working fine while putting it in separate search. 

And you're right I shouldn't use "table" command but since nothing was working so just for workaround I tried to use it. 

[gcusello]

Hi @Rao_KGY ,

could you share your dashboard code?

maybe there something else.

Ciao.

Giuseppe

[Rao_KGY]

@gcusello even timechart command also not working for me. JFYI I did try to create new dashboard by adding these queries to panel but I was getting same error. 

I have created multiple dashboard before but never faced such issue. 
Following is the source code of errored dashboard. 

<dashboard version="1.1" theme="light">
<label>CSC Impacted Services Health</label>
<row>
<panel>
<title>Build Profile Failures-CIAM Service Impact</title>
<chart>
<search>
<query>index=app_pl Appid-APP-3515 Environment="PROD" "com.thehartford.pl.model.exception.CscServiceException: null
at com.thehartford.pl.rest.UserProfileController.builduserProfile"
| timechart count As Failure span=1h</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="charting.chart">column</option>
<option name="charting.drilldown">all</option>
<option name="refresh.display">progressbar</option>
<drilldown>
<link target="_self">search?q=index%3Dapp_p1%20Appid%3DAPP-3515%20Environment%3D%22PROD%22%20%22com.thehartford.pl.mo
.rest.UserProfileController.buildUserProfile%22%0A%7Crex%20%22CIAMSESSION%20%3A%20(%3F%3Cciamsession%3E%5B%5Cw%5Cs%
(%3F%3Cuserid%3E%5B%5C%5C%40%5C.%5D%2B) %22%0A%7C%20bin%20span%3D1h%20_time%20%0A%60%60%60%7C%20table%20ciamsession
me&amp; earliest-$field1.earliest$&amp; latest-$field1.latest$</link>
</drilldown>
</chart>
</panel>
<panel>
<title>Build Profile Failures- CIAM Service Impact</title>
<table>
<search>
<query>index=app_pl Appid=APP-3515 Environment="PROD" "com.thehartford.pl.model.exception.CscService Exception: null
at com.thehartford.pl.rest.UserProfileController.buildUserProfile"
| bin span=1h _time
l stats count as Failure by _time</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</row>
</dashboard>
</search>
<option name="count">50</option>
<option name="dataoverlayMode">none</option>
<option name="drilldown">none</option>.
<option name="percentages Row">false</option>
<option name="refresh.display">progressbar</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
</table>
</panel>

[gcusello]

Hi @Rao_KGY ,

there's a difference in the first row of the searches:

in the first search you have: com.thehartford.pl.model.exception.CscServiceException:

in the second one, you have: com.thehartford.pl.model.exception.CscService Exception:

in other words, there's an additional space in the second search, maybe this is the reason.

Ciao.

Giuseppe

[Rao_KGY]

That space is not the issue @gcusello . Mistake happened since I took pic of source code, then extracted text from those pics via open source website & later pasted here so during this process only that mistake occurred. Thanks    

[gcusello]

Hi @Rao_KGY ,

good for you, see next time!

let us know if we can help you more, or, please, accept one answer for the other people of Community (even if your answer).

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉

[Rao_KGY]

Hey @gcusello  seems like there is some confusion. My issue is still stand UNRESOLVED & trying to get resolution. 

Thanks

[gcusello]

Hi @Rao_KGY ,

the code of your dashboard is correct (except the difference I already described), I don't see any reason because two equal searches give different results.

Try to manually copy one on the other, maybe there's some char that we don't see.

Ciao.

Giuseppe

[ITWhisperer]

Your timeframes could be different?