Im practicing in creating Dashboards using base search and my dashboard has a piechart wich says "no results found", but when i click on "open in search" i get the results as stats in search and have no probs to visualize via the visualizationtab.
my Dashboard sourcecode:
<dashboard>
<label>Basesearch Test</label>
<search id="basesearch">
<query>index=fishingbot</query>
<earliest>$timepickearliest$</earliest>
<latest>$timepicklatest$</latest>
</search>
<row>
<panel>
<title>Sessionstart</title>
<single>
<search base="basesearch">
<query>eval start = strftime($timepickearliest$, "%d.%m.%Y %H:%M:%S") | table start</query>
</search>
<option name="drilldown">none</option>
</single>
</panel>
<panel>
<title>Sessionende</title>
<single>
<search base="basesearch">
<query>eval end = strftime($timepicklatest$, "%d.%m.%Y %H:%M:%S") | table end</query>
</search>
<option name="drilldown">none</option>
</single>
</panel>
</row>
<row>
<panel>
<chart>
<search base="basesearch">
<query>rex field=message "\"(?<Loot>\w+)\" gefischt" | stats count by Loot</query>
</search>
<option name="charting.chart">pie</option>
<option name="charting.drilldown">none</option>
<option name="refresh.display">progressbar</option>
</chart>
</panel>
</row>
</dashboard>
The Timepick comes from a Drilldown in another Dashboard where the Botsessions are listed.
I tried it with chart instead of stats, but its the same result.
Where did i got the flaw?
The base search is not transforming. This is known to cause the "no results found" problem. See https://docs.splunk.com/Documentation/Splunk/8.2.2/Viz/Savedsearches#Post-process_searches_2
Try adding | fields message to the base query as a workaround
The base search is not transforming. This is known to cause the "no results found" problem. See https://docs.splunk.com/Documentation/Splunk/8.2.2/Viz/Savedsearches#Post-process_searches_2
Try adding | fields message to the base query as a workaround
After testing and thinking im stupid i found it out by myself.
It was the field i told regex to use.
I changed
<query>rex field=message "\"(?<Loot>\w+)\" gefischt" | stats count by Loot</query>
to
<query>rex "\"(?<Loot>\w+)\" gefischt" | stats count by Loot</query>
and it worked.
I think splunk didnt recognized the extracted field named message because it couldnt refer to the fieldextraction, that was created in the context of the index i only wrote in the base search.