Radial gauge not showing in form

[stjack99]

I'm trying to make a form where I can select a host, and then get various kinds of perfmon & wmi info about it. So far, I can get it to dump data into normal line charts, but if I try to get it to dump data into a radial gauge, the gauge doesn't show and the following message is displayed instead: Search did not generate any statistical results.

Here's a screenshot of the form running.

Here's the code of my form.

    <?xml version='1.0' encoding='utf-8'?>
<form>
  <label>Server Performance - Detailed</label>
  <searchTemplate>host="$host$" AND (sourcetype="Perfmon*" OR sourcetype="WMI*") | fields + host, counter, sourcetype, instance, Value</searchTemplate>
  <earliestTime>rt-30m</earliestTime>
  <latestTime>rt</latestTime> 

  <fieldset>
    <input type="radio" token="host">
      <label>Select Host</label>
      <populatingSearch fieldForValue="host" fieldForLabel="host">sourcetype="Perfmon*" OR sourcetype="WMI*" earliest="-60m" latest="now" | dedup host | table host | sort host</populatingSearch>
    </input>
  </fieldset>

  <row>
    <chart>
      <searchPostProcess>where sourcetype="Perfmon:LogicalDisk" AND counter="% Disk Read Time" AND NOT instance="_Total" | stats last(Value) AS lastValue by instance | stats max(lastValue) AS maxValue | gauge maxValue</searchPostProcess>
      <title>test</title>
      <option name="charting.chart">radialGauge</option>
      <option name="charting.chart.style">shiny</option>
    </chart>

    <table>
      <searchPostProcess>search sourcetype="Perfmon:LogicalDisk" counter="% Disk Read Time" NOT instance="_Total" | stats last(Value) AS Value by instance | stats max(Value) AS Value</searchPostProcess>
      <title>test</title>
    </table>
  </row>

  <row>
    <chart>
      <searchPostProcess>search sourcetype="Perfmon:LogicalDisk" counter="% Disk Write Time" NOT instance="_Total" | timechart avg(Value) by instance</searchPostProcess>
      <title>% Disk Write Time</title>
      <option name="chartTitle">% Disk Write Time</option>
      <option name="charting.chart">line</option>
      <option name="charting.chart.nullValueMode">zero</option>
      <option name="charting.legend.placement">top</option>
      <option name="drilldown">none</option>
      <option name="primaryAxisTitle.text">Time</option>
      <option name="secondaryAxisTitle.text">% Write Time</option>
      <option name="charting.scaleX">1</option>
    </chart>

    <chart>
      <searchPostProcess>search sourcetype="Perfmon:LogicalDisk" counter="% Disk Read Time" NOT instance="_Total" | timechart avg(Value) by instance</searchPostProcess>
      <title>% Disk Read Time</title>
      <option name="chartTitle">% Disk Read Time</option>
      <option name="charting.chart">line</option>
      <option name="charting.chart.nullValueMode">zero</option>
      <option name="charting.legend.placement">top</option>
      <option name="drilldown">none</option>
      <option name="primaryAxisTitle.text">Time</option>
      <option name="secondaryAxisTitle.text">% Read Time</option>
      <option name="charting.scaleX">1</option>
    </chart>
  </row>
</form>

[stjack99 · Accepted solution]

I finally figured it out. I forgot to add the following line to the chart:
1

Add that, remove the gauge part at the end, and it works.

<chart>
  <searchPostProcess>search sourcetype="Perfmon:LogicalDisk" AND counter="% Disk Read Time" AND NOT instance="_Total" | stats last(Value) AS lastValue by instance | stats max(lastValue) AS maxValue</searchPostProcess>
  <title>test</title>
  <option name="charting.chart">radialGauge</option>
  <option name="charting.chart.style">shiny</option>
  <option name="charting.scaleX">1</option>
</chart>

[Simon_Fishel]

This configuration should now work with the JSChart module in 4.3.1

[Simon_Fishel]

Oh I see, I was thrown off by the fact that the line charts worked and the gauge didn't, but it's because you had forced them to use the Flash renderer. There is a bug with post-processing in the new non-Flash charting module.

If you're ok with Flash charts, you're all set. But you can also work around this in some cases by modifying the base search. See this post:

http://splunk-base.splunk.com/answers/38685/jschart-search-postprocess-search-did-not-generate-any-s...

[Simon_Fishel]

It could be the 'where' command in your post-process that is causing the problem. You might try starting the post-process for the gauge in the same way as the other charts ("search sourcetype=...").

[stjack99]

I actually had that originally. I tried a bunch of different search queries to no avail.