Dashboards & Visualizations

Pie-Chart "no results found" in Dashboard with base search

TheEggi98
Explorer

Im practicing in creating Dashboards using base search and my dashboard has a piechart wich says "no results found", but when i click on "open in search" i get the results as stats in search and have no probs to visualize via the visualizationtab.


my Dashboard sourcecode:

 

<dashboard>
  <label>Basesearch Test</label>
  <search id="basesearch">
    <query>index=fishingbot</query>
    <earliest>$timepickearliest$</earliest>
    <latest>$timepicklatest$</latest>
  </search>
  <row>
    <panel>
      <title>Sessionstart</title>
      <single>
        <search base="basesearch">
          <query>eval start = strftime($timepickearliest$, "%d.%m.%Y %H:%M:%S") | table start</query>
        </search>
        <option name="drilldown">none</option>
      </single>
    </panel>
    <panel>
      <title>Sessionende</title>
      <single>
        <search base="basesearch">
          <query>eval end = strftime($timepicklatest$, "%d.%m.%Y %H:%M:%S") | table end</query>
        </search>
        <option name="drilldown">none</option>
      </single>
    </panel>
  </row>
  <row>
    <panel>
      <chart>
        <search base="basesearch">
          <query>rex field=message "\"(?&lt;Loot&gt;\w+)\" gefischt" | stats count by Loot</query>
        </search>
        <option name="charting.chart">pie</option>
        <option name="charting.drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </chart>
    </panel>
  </row>
</dashboard>

 

The Timepick comes from a Drilldown in another Dashboard where the Botsessions are listed.

I tried it with chart instead of stats, but its the same result.

Where did i got the flaw?

Labels (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

The base search is not transforming.  This is known to cause the "no results found" problem.  See https://docs.splunk.com/Documentation/Splunk/8.2.2/Viz/Savedsearches#Post-process_searches_2

Try adding | fields message to the base query as a workaround

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

The base search is not transforming.  This is known to cause the "no results found" problem.  See https://docs.splunk.com/Documentation/Splunk/8.2.2/Viz/Savedsearches#Post-process_searches_2

Try adding | fields message to the base query as a workaround

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

TheEggi98
Explorer

After testing and thinking im stupid i found it out by myself.
It was the field i told regex to use.

I changed

<query>rex field=message "\"(?&lt;Loot&gt;\w+)\" gefischt" | stats count by Loot</query>

to

<query>rex "\"(?&lt;Loot&gt;\w+)\" gefischt" | stats count by Loot</query>

and it worked.

I think splunk didnt recognized the extracted field named message because it couldnt refer to the fieldextraction, that was created in the context of the index i only wrote in the base search.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!