Dashboards & Visualizations

Why is query not plotting multi-series line chart?

Jeet
Explorer
| regex "message.message"="Total count XXXXXX: |Total rows YYYYYY: " | rex field="message.message" max_match=0 "^(?<msg1>[^:]*)\:(?<msg2>[^:]*)\:(?<msg3>[^:]*)\:(?<msg4>[^:]*)($|\{)" | eval dtonly=strftime(_time, "%Y%m%d") | chart first(msg4) OVER dtonly BY msg3

I get the stats but not the visualization.

 

Thanks

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

It looks like you might have a space between the : and the numbers. The values are left aligned, indicating a string rather than a numeric. Try accounting for the space (if it is there) and only extract digits for msg4.

| rex field="message.message" max_match=0 "^(?<msg1>[^:]*)\:(?<msg2>[^:]*)\:(?<msg3>[^:]*)\:\s*(?<msg4>\d*)"

View solution in original post

0 Karma

Jeet
Explorer

Is that what you are looking for? Sorry! I am new to Splunk.

0 Karma

Jeet
Explorer

It's a glue job log output, something like this. one run per day.

 

INFO:__main__:Total rows: 893

...

INFO:__main__:Total count in segments schema: 18504

0 Karma

BlueSocket
Contributor

@Jeet, you might want to check the maximum number of values that are supported by the visualization that you have selected to output. I have had this happen to me - I can see the (>50,000) values, but the visualization only supports 50,000 rows. That >18,000 might be too high.

0 Karma

Jeet
Explorer

Data to be plotted won't be more than 50 rows. Enclosing stat output for 2 rows which is not getting plotted.

 

Jeet_0-1662046094574.png

 

 

Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

It looks like you might have a space between the : and the numbers. The values are left aligned, indicating a string rather than a numeric. Try accounting for the space (if it is there) and only extract digits for msg4.

| rex field="message.message" max_match=0 "^(?<msg1>[^:]*)\:(?<msg2>[^:]*)\:(?<msg3>[^:]*)\:\s*(?<msg4>\d*)"
0 Karma

Jeet
Explorer

That did the trick. Thank you!!

0 Karma

BlueSocket
Contributor

So.... What do you see when you switch to the visualization and which visualization are you trying to use?

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Can you share some events in a code block </> so we can better see what you are dealing with?

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...