Dashboards & Visualizations

Why is query not plotting multi-series line chart?

Jeet
Explorer
| regex "message.message"="Total count XXXXXX: |Total rows YYYYYY: " | rex field="message.message" max_match=0 "^(?<msg1>[^:]*)\:(?<msg2>[^:]*)\:(?<msg3>[^:]*)\:(?<msg4>[^:]*)($|\{)" | eval dtonly=strftime(_time, "%Y%m%d") | chart first(msg4) OVER dtonly BY msg3

I get the stats but not the visualization.

 

Thanks

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

It looks like you might have a space between the : and the numbers. The values are left aligned, indicating a string rather than a numeric. Try accounting for the space (if it is there) and only extract digits for msg4.

| rex field="message.message" max_match=0 "^(?<msg1>[^:]*)\:(?<msg2>[^:]*)\:(?<msg3>[^:]*)\:\s*(?<msg4>\d*)"

View solution in original post

0 Karma

Jeet
Explorer

Is that what you are looking for? Sorry! I am new to Splunk.

0 Karma

Jeet
Explorer

It's a glue job log output, something like this. one run per day.

 

INFO:__main__:Total rows: 893

...

INFO:__main__:Total count in segments schema: 18504

0 Karma

BlueSocket
Contributor

@Jeet, you might want to check the maximum number of values that are supported by the visualization that you have selected to output. I have had this happen to me - I can see the (>50,000) values, but the visualization only supports 50,000 rows. That >18,000 might be too high.

0 Karma

Jeet
Explorer

Data to be plotted won't be more than 50 rows. Enclosing stat output for 2 rows which is not getting plotted.

 

Jeet_0-1662046094574.png

 

 

Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

It looks like you might have a space between the : and the numbers. The values are left aligned, indicating a string rather than a numeric. Try accounting for the space (if it is there) and only extract digits for msg4.

| rex field="message.message" max_match=0 "^(?<msg1>[^:]*)\:(?<msg2>[^:]*)\:(?<msg3>[^:]*)\:\s*(?<msg4>\d*)"
0 Karma

Jeet
Explorer

That did the trick. Thank you!!

0 Karma

BlueSocket
Contributor

So.... What do you see when you switch to the visualization and which visualization are you trying to use?

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Can you share some events in a code block </> so we can better see what you are dealing with?

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...