Dashboards & Visualizations

Radial gauge not showing in form

Explorer

I'm trying to make a form where I can select a host, and then get various kinds of perfmon & wmi info about it. So far, I can get it to dump data into normal line charts, but if I try to get it to dump data into a radial gauge, the gauge doesn't show and the following message is displayed instead: Search did not generate any statistical results.

Here's a screenshot of the form running.

Here's the code of my form.

    <?xml version='1.0' encoding='utf-8'?>
<form>
  <label>Server Performance - Detailed</label>
  <searchTemplate>host="$host$" AND (sourcetype="Perfmon*" OR sourcetype="WMI*") | fields + host, counter, sourcetype, instance, Value</searchTemplate>
  <earliestTime>rt-30m</earliestTime>
  <latestTime>rt</latestTime> 

  <fieldset>
    <input type="radio" token="host">
      <label>Select Host</label>
      <populatingSearch fieldForValue="host" fieldForLabel="host">sourcetype="Perfmon*" OR sourcetype="WMI*" earliest="-60m" latest="now" | dedup host | table host | sort host</populatingSearch>
    </input>
  </fieldset>

  <row>
    <chart>
      <searchPostProcess>where sourcetype="Perfmon:LogicalDisk" AND counter="% Disk Read Time" AND NOT instance="_Total" | stats last(Value) AS lastValue by instance | stats max(lastValue) AS maxValue | gauge maxValue</searchPostProcess>
      <title>test</title>
      <option name="charting.chart">radialGauge</option>
      <option name="charting.chart.style">shiny</option>
    </chart>

    <table>
      <searchPostProcess>search sourcetype="Perfmon:LogicalDisk" counter="% Disk Read Time" NOT instance="_Total" | stats last(Value) AS Value by instance | stats max(Value) AS Value</searchPostProcess>
      <title>test</title>
    </table>
  </row>

  <row>
    <chart>
      <searchPostProcess>search sourcetype="Perfmon:LogicalDisk" counter="% Disk Write Time" NOT instance="_Total" | timechart avg(Value) by instance</searchPostProcess>
      <title>% Disk Write Time</title>
      <option name="chartTitle">% Disk Write Time</option>
      <option name="charting.chart">line</option>
      <option name="charting.chart.nullValueMode">zero</option>
      <option name="charting.legend.placement">top</option>
      <option name="drilldown">none</option>
      <option name="primaryAxisTitle.text">Time</option>
      <option name="secondaryAxisTitle.text">% Write Time</option>
      <option name="charting.scaleX">1</option>
    </chart>

    <chart>
      <searchPostProcess>search sourcetype="Perfmon:LogicalDisk" counter="% Disk Read Time" NOT instance="_Total" | timechart avg(Value) by instance</searchPostProcess>
      <title>% Disk Read Time</title>
      <option name="chartTitle">% Disk Read Time</option>
      <option name="charting.chart">line</option>
      <option name="charting.chart.nullValueMode">zero</option>
      <option name="charting.legend.placement">top</option>
      <option name="drilldown">none</option>
      <option name="primaryAxisTitle.text">Time</option>
      <option name="secondaryAxisTitle.text">% Read Time</option>
      <option name="charting.scaleX">1</option>
    </chart>
  </row>
</form>
Tags (2)
0 Karma
1 Solution

Explorer

I finally figured it out. I forgot to add the following line to the chart:
1

Add that, remove the gauge part at the end, and it works.

<chart>
  <searchPostProcess>search sourcetype="Perfmon:LogicalDisk" AND counter="% Disk Read Time" AND NOT instance="_Total" | stats last(Value) AS lastValue by instance | stats max(lastValue) AS maxValue</searchPostProcess>
  <title>test</title>
  <option name="charting.chart">radialGauge</option>
  <option name="charting.chart.style">shiny</option>
  <option name="charting.scaleX">1</option>
</chart>

View solution in original post

0 Karma

Explorer

I finally figured it out. I forgot to add the following line to the chart:
1

Add that, remove the gauge part at the end, and it works.

<chart>
  <searchPostProcess>search sourcetype="Perfmon:LogicalDisk" AND counter="% Disk Read Time" AND NOT instance="_Total" | stats last(Value) AS lastValue by instance | stats max(lastValue) AS maxValue</searchPostProcess>
  <title>test</title>
  <option name="charting.chart">radialGauge</option>
  <option name="charting.chart.style">shiny</option>
  <option name="charting.scaleX">1</option>
</chart>

View solution in original post

0 Karma

Splunk Employee
Splunk Employee

This configuration should now work with the JSChart module in 4.3.1

0 Karma

Splunk Employee
Splunk Employee

Oh I see, I was thrown off by the fact that the line charts worked and the gauge didn't, but it's because you had forced them to use the Flash renderer. There is a bug with post-processing in the new non-Flash charting module.

If you're ok with Flash charts, you're all set. But you can also work around this in some cases by modifying the base search. See this post:

http://splunk-base.splunk.com/answers/38685/jschart-search-postprocess-search-did-not-generate-any-s...

0 Karma

Splunk Employee
Splunk Employee

It could be the 'where' command in your post-process that is causing the problem. You might try starting the post-process for the gauge in the same way as the other charts ("search sourcetype=...").

0 Karma

Explorer

I actually had that originally. I tried a bunch of different search queries to no avail.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!