Dashboards & Visualizations

Search fails when moved to Dashboard


I'm new to Splunk.

I've got a Search that works fine in the Search screen and correctly generates a bar chart.

index="production" source="s3://hydrow-android-logs-input-queue-prod/console/*" logWorkoutEndDebugStats releaseStage="production"
| rename workoutEndInfo.videoRestartStats.videoStopped as videoStops
| stats count by buildNumber, videoStops
| eventstats sum(count) as itemTotal by buildNumber
| eval percentage=round((count / itemTotal) * 100 , 1 )
| search videoStops = true
| chart values(percentage) over buildNumber by videoStops


Error when rendering as chart on a dashboard:

Screen Shot 2021-09-18 at 11.12.43 AM.png


When I Save it to a dashboard or create a new chart on the dashboard and enter the search as the datasource, I get the error below.  if I change the visualization from a chart to a table, then the table renders fine.  There's no indication of why the visualization works fine on the Search page, but not the dashboard.  

Any suggestions on how to debug this would be very welcome!



Labels (1)


@joelm1822 Can you show the source code error ?

0 Karma

Path Finder

Do the _internal logs provide any additional information?

Does the same issue occur regardless of whether the search is inline or report-driven?

Does the browser console provide some more insight into the JavaScript error?

Potentially authorisation or app scope issues, or a need to separate into base and post process searches.

0 Karma


I don't know how to find the source code of the error. I'll do some digging to find the internal logs.  (I'm new to Splunk and more used to tools that show you the error rather than hiding it log files somewhere else.  Is it even possible with SplunkCloud?)

Path Finder

I've dug into this one a bit, and I believe it could be due to the way Splunk uses XML to handle the visualisations. Have you tried using stats instead of chart or table, and then formatting the visualisation as a chart using the GUI?

The XML for an area chart should look something like the following, for example:

<option name="charting.chart">area</option>

I.e. the chart XML is independent from the results returned by the search.

I've worked almost exclusively with on-premises instances, so I can't speak to the accessibility of the _internal index in Splunk cloud, though pressing F12 in your browser to display the console may hint at any other problems that could be occurring here.

Let me know how you go.

0 Karma
Get Updates on the Splunk Community!

Splunk Life | Happy Pride Month!

Happy Pride Month, Splunk Community! &#x1f308; In the United States, as well as many countries around the ...

SplunkTrust | Where Are They Now - Michael Uschmann

The Background Five years ago, Splunk published several videos showcasing members of the SplunkTrust to share ...

Admin Your Splunk Cloud, Your Way

Join us to maximize different techniques to best tune Splunk Cloud. In this Tech Enablement, you will get ...