Why is query not plotting multi-series line chart?

[Jeet]

| regex "message.message"="Total count XXXXXX: |Total rows YYYYYY: " | rex field="message.message" max_match=0 "^(?<msg1>[^:]*)\:(?<msg2>[^:]*)\:(?<msg3>[^:]*)\:(?<msg4>[^:]*)($|\{)" | eval dtonly=strftime(_time, "%Y%m%d") | chart first(msg4) OVER dtonly BY msg3

I get the stats but not the visualization.

Thanks

[Jeet]

Is that what you are looking for? Sorry! I am new to Splunk.

[Jeet]

It's a glue job log output, something like this. one run per day.

INFO:__main__:Total rows: 893

...

INFO:__main__:Total count in segments schema: 18504

[BlueSocket]

@Jeet, you might want to check the maximum number of values that are supported by the visualization that you have selected to output. I have had this happen to me - I can see the (>50,000) values, but the visualization only supports 50,000 rows. That >18,000 might be too high.

[Jeet]

Data to be plotted won't be more than 50 rows. Enclosing stat output for 2 rows which is not getting plotted.

[ITWhisperer · Accepted solution]

It looks like you might have a space between the : and the numbers. The values are left aligned, indicating a string rather than a numeric. Try accounting for the space (if it is there) and only extract digits for msg4.

| rex field="message.message" max_match=0 "^(?<msg1>[^:]*)\:(?<msg2>[^:]*)\:(?<msg3>[^:]*)\:\s*(?<msg4>\d*)"

[Jeet]

That did the trick. Thank you!!

[BlueSocket]

So.... What do you see when you switch to the visualization and which visualization are you trying to use?

[ITWhisperer]

Can you share some events in a code block </> so we can better see what you are dealing with?