Dashboards & Visualizations

PARSER: Applying intentions failed Unable to drilldown because of post-reporting 'filnull' command

anandhim
Path Finder

Hi,

We are using simple xml dashoboard and recently a user received this error while clicking on one of the charts. I have not been able to reproduce it, but wondering if anybody has seen this error with fillnull command ?

The search string is

  <searchString>

index=XYZ sourcetype=iis_access_log host=pop3web* OR host=popiweb* cm=PROD | eval time_taken=time_taken/1000 | timechart avg(time_taken) by host useother=f limit=100 | fillnull value=0

Tags (1)
1 Solution

dart
Splunk Employee
Splunk Employee

It's the post reporting nature of the command that is doing this. Can you rework the search to have the fillnull before like so index=XYZ sourcetype=iis_access_log host=pop3web OR host=popiweb cm=PROD | eval time_taken=time_taken/1000 | fillnull value=0 time_taken | timechart avg(time_taken) by host useother=f limit=100 and does that work?

View solution in original post

dart
Splunk Employee
Splunk Employee

It's the post reporting nature of the command that is doing this. Can you rework the search to have the fillnull before like so index=XYZ sourcetype=iis_access_log host=pop3web OR host=popiweb cm=PROD | eval time_taken=time_taken/1000 | fillnull value=0 time_taken | timechart avg(time_taken) by host useother=f limit=100 and does that work?

dart
Splunk Employee
Splunk Employee

You could override the default drilldown with dynamic drilldown

anandhim
Path Finder

Unfortunately, we are still on 4.3.4 and will take us time to eval and then upgrade to version 5. I was curious to find the reason when this kind of error would occur so I can reproduce and resolve it.

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...