Pie-Chart "no results found" in Dashboard with base search

[TheEggi98]

Im practicing in creating Dashboards using base search and my dashboard has a piechart wich says "no results found", but when i click on "open in search" i get the results as stats in search and have no probs to visualize via the visualizationtab.

my Dashboard sourcecode:

<dashboard>
  <label>Basesearch Test</label>
  <search id="basesearch">
    <query>index=fishingbot</query>
    <earliest>$timepickearliest$</earliest>
    <latest>$timepicklatest$</latest>
  </search>
  <row>
    <panel>
      <title>Sessionstart</title>
      <single>
        <search base="basesearch">
          <query>eval start = strftime($timepickearliest$, "%d.%m.%Y %H:%M:%S") | table start</query>
        </search>
        <option name="drilldown">none</option>
      </single>
    </panel>
    <panel>
      <title>Sessionende</title>
      <single>
        <search base="basesearch">
          <query>eval end = strftime($timepicklatest$, "%d.%m.%Y %H:%M:%S") | table end</query>
        </search>
        <option name="drilldown">none</option>
      </single>
    </panel>
  </row>
  <row>
    <panel>
      <chart>
        <search base="basesearch">
          <query>rex field=message "\"(?&lt;Loot&gt;\w+)\" gefischt" | stats count by Loot</query>
        </search>
        <option name="charting.chart">pie</option>
        <option name="charting.drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </chart>
    </panel>
  </row>
</dashboard>

The Timepick comes from a Drilldown in another Dashboard where the Botsessions are listed.

I tried it with chart instead of stats, but its the same result.

Where did i got the flaw?

[richgalloway · Accepted solution]

The base search is not transforming.  This is known to cause the "no results found" problem.  See https://docs.splunk.com/Documentation/Splunk/8.2.2/Viz/Savedsearches#Post-process_searches_2

Try adding | fields message to the base query as a workaround

[TheEggi98]

After testing and thinking im stupid i found it out by myself.
It was the field i told regex to use.

I changed

<query>rex field=message "\"(?&lt;Loot&gt;\w+)\" gefischt" | stats count by Loot</query>

to

<query>rex "\"(?&lt;Loot&gt;\w+)\" gefischt" | stats count by Loot</query>

and it worked.

I think splunk didnt recognized the extracted field named message because it couldnt refer to the fieldextraction, that was created in the context of the index i only wrote in the base search.