Splunk Dashboard - search returns null

[DarrellR]

I have created a dashboard that reads a MQ flow that contains messages to different vendors.  I have created panels for the different vendors and am trying to group the messages for each of those vendors.  Each Vendor will receive 2 message types ASM and SSM.  2 panels work but the other does not, it only returns NULL yet there are messages.

The search is exactly the same for all three with the exception of the Vendor address, here is the search

index="emh_prd" ACXForm="TTYIN:MULEOUT:TTYOUT" XXXXXX AND .YYYYYY
| timechart count by DR1

The XXXXXX is the Vendor address and .YYYYYYY is the sender address.  The sender address will stay the same but the each panel will have a different XXXXXX value

I can not figure out why only that 1 does not work and returns NULL when it receives basically the same messages just with a different XXXXXX value

I hope someone here can help me

[DarrellR]

Here is the events from left to right for the 3 panels.

So here the DR1 is not showing but the 1st and 3rd panels work but the middle one does not.  The characters in the RED box is what the DR1 is looking for either SSM or ASM

[gcusello]

Hi @DarrellR ,

are you sure that all the events have the DR1 field?

you could try to add DR1=* to the main search.

Ciao.

Giuseppe

[DarrellR]

Hi @gcusello ,

Thanks for the quick reply!  I am new to this, where would I add the DR1=* in my search?

Also not all the panels have the DR1 in there events but they still work.  This is part of why I don't understand why some work and not others.

[gcusello]

Hi @DarrellR ,

as also @isoutamo said, you should put it in the main search.

Ciao.

Giuseppe

[isoutamo]

Here is your original search 

index="emh_prd" ACXForm="TTYIN:MULEOUT:TTYOUT" XXXXXX AND .YYYYYY
| timechart count by DR1

You should do it like

index="emh_prd" ACXForm="TTYIN:MULEOUT:TTYOUT" XXXXXX AND .YYYYYY DR1=*
| timechart count by DR1

or

index="emh_prd" ACXForm="TTYIN:MULEOUT:TTYOUT" XXXXXX AND .YYYYYY
| eval DR1 = coalesce(DR1, "DR1 N/A")
| timechart count by DR1

 https://docs.splunk.com/Documentation/Splunk/9.4.0/SearchReference/ConditionalFunctions#coalesce.28....

[DarrellR]

Thanks but neither of those seem to work, I still get NULL even though there are messages.  This is very frustrating

[isoutamo]

Are you sure that those queries are used on those panels? Or are there some other filtering after those queries which remove all results?

Can you share those panels source and also your sample data (with anonymous values when needed)?

[DarrellR]

This is panel 1

[DarrellR]

This is panel 2 [the one showing NULL]

[DarrellR]

Here is the source for the 2nd panel

<chart>
<title>SchedConnect Messages to {nnnn]</title>
<search>
<query>index="emh_prd" ACXForm="TTYIN:MULEOUT:TTYOUT" XXXXXX AND .YYYYYY
| timechart count by DR1</query>
<earliest>$TimePickerKielToken.earliest$</earliest>
<latest>$TimePickerKielToken.latest$</latest>
<refresh>1m</refresh>
<refreshType>delay</refreshType>
</search>
<option name="charting.axisTitleX.text">Time</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.chart">column</option>
<option name="charting.drilldown">all</option>
<option name="charting.legend.placement">right</option>
<option name="refresh.display">progressbar</option>
<option name="trellis.enabled">0</option>
<option name="trellis.size">medium</option>
</chart>
</panel>
<panel>
<chart>

[DarrellR]

here is the source for the 1st panel

<row>
<panel>
<chart>
<title>SchedConnect Messages to [nnnnn]</title>
<search>
<query>index="emh_prd" ACXForm="TTYIN:MULEOUT:TTYOUT" XXXXXX AND .YYYYYY
| timechart count by DR1</query>
<earliest>$TimePickerKielToken.earliest$</earliest>
<latest>$TimePickerKielToken.latest$</latest>
<refresh>1m</refresh>
<refreshType>delay</refreshType>
</search>
<option name="charting.axisTitleX.text">Time</option>
<option name="charting.chart">column</option>
<option name="charting.drilldown">all</option>
<option name="charting.legend.placement">right</option>
<option name="refresh.display">progressbar</option>
</chart>
</panel>
<panel>
<chart>

[DarrellR]

Here is the source code all together for those panels - left to right, might be easier to debug

<row>
<panel>
<chart>
<title>SchedConnect Messages to [nnnnn]</title>
<search>
<query>index="emh_prd" ACXForm="TTYIN:MULEOUT:TTYOUT" XXXXXX AND .YYYYYY
| timechart count by DR1</query>
<earliest>$TimePickerKielToken.earliest$</earliest>
<latest>$TimePickerKielToken.latest$</latest>
<refresh>1m</refresh>
<refreshType>delay</refreshType>
</search>
<option name="charting.axisTitleX.text">Time</option>
<option name="charting.chart">column</option>
<option name="charting.drilldown">all</option>
<option name="charting.legend.placement">right</option>
<option name="refresh.display">progressbar</option>
</chart>
</panel>
<panel>
<chart>
<title>SchedConnect Messages to {nnnnn]</title>
<search>
<query>index="emh_prd" ACXForm="TTYIN:MULEOUT:TTYOUT" XXXXXX AND .YYYYY
| timechart count by DR1</query>
<earliest>$TimePickerKielToken.earliest$</earliest>
<latest>$TimePickerKielToken.latest$</latest>
<refresh>1m</refresh>
<refreshType>delay</refreshType>
</search>
<option name="charting.axisTitleX.text">Time</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.chart">column</option>
<option name="charting.drilldown">all</option>
<option name="charting.legend.placement">right</option>
<option name="refresh.display">progressbar</option>
</chart>
</panel>
<panel>
<chart>
<title>SchedConnect Messages to [nnnnn]</title>
<search>
<query>index="emh_prd" ACXForm="TTYIN:MULEOUT:TTYOUT" XXXXXX AND .YYYYYY
| timechart count by DR1</query>
<earliest>$TimePickerKielToken.earliest$</earliest>
<latest>$TimePickerKielToken.latest$</latest>
<refresh>1m</refresh>
<refreshType>delay</refreshType>
</search>
<option name="charting.axisTitleX.text">Time</option>
<option name="charting.chart">column</option>
<option name="charting.drilldown">all</option>
<option name="refresh.display">progressbar</option>
</chart>
</panel>

[isoutamo]

Thanx. Next time when you paste something please use </> code block to avoid character changes etc. 

Based on those I suppose that your data haven't correct values what you are looking for. You should check it by clicking magnifying class on right bottom corner of your dashboard's individual panel. This opens exactly same search you to separate window/tab and you can see what events it found. Then you can debug it by e.g. commenting rows away from bottom to top. 

[DarrellR]

Hi @isoutamo ,

I will do that next time I post, thank you.  I have checked the search and aside from the XXXXXX values being the address for the different vendors, each panel uses the exact same search, it is just for 1 I get NULL values even though the messages are there when I look at the events