Monitoring Splunk

chart command field only displayed when i add a filter

sophiacyh
Explorer

Hello Splunk Community!

I have a query where im extracting data from different logs and displaying them on the same row in a statistical table.

here is my code:

 

index=main source=/opt/server/*/*userauth* 
| rex field=_raw "\]\s\S+\s-\s\[(?<caller>\S+)\]\s\S+->(?<function>\S+)\s(?<logs>.+)\:\s\[(?<value>\S+)\]" 
| where isnotnull(caller) 
| chart values(value) over caller by logs useother=f

 

i used the chart command to turn the logs  into column headers with their respective values

The result :

callerlogBlogClogD
caller_idvalueBvalueCvalueD

however, when i narrow down the search by adding "validateSB" which is contained in most log entries,

 

index=main source=/opt/server/*/*userauth* validateSB
| rex field=_raw "\]\s\S+\s-\s\[(?<caller>\S+)\]\s\S+->(?<function>\S+)\s(?<logs>.+)\:\s\[(?<value>\S+)\]" 
| where isnotnull(caller) 
| chart values(value) over caller by logs useother=f

 

 The column A now appears as a column header with its respective value.

callerlogAlogBlogClogD
caller_idvalueAvalueBvalueCvalueD

When i also search a specific caller, the column A appears with its respective value too.

Anybody know why this might be the case?

Thanks in advance!

0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @sophiacyh,

probably you have few values that in the main search aren't displayed, instead when you add the additional field, the percentage of that value is greater so it's displayed in the chart command.

If you see at https://docs.splunk.com/Documentation/Splunk/8.2.6/SearchReference/Chart the default value for the "limit" option is 10, you could add a greater value for this option, but obviously in this way you'll have much many columns.

As I said, you could change the value for the limit option, or eventually think your search in two steps:

a first panel with all values, andd, with a click on one row, a drilldown adding an additional filter.

Ciao.

Giuseppe

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @sophiacyh,

probably you have few values that in the main search aren't displayed, instead when you add the additional field, the percentage of that value is greater so it's displayed in the chart command.

If you see at https://docs.splunk.com/Documentation/Splunk/8.2.6/SearchReference/Chart the default value for the "limit" option is 10, you could add a greater value for this option, but obviously in this way you'll have much many columns.

As I said, you could change the value for the limit option, or eventually think your search in two steps:

a first panel with all values, andd, with a click on one row, a drilldown adding an additional filter.

Ciao.

Giuseppe

0 Karma

sophiacyh
Explorer

Thank you ! @gcusello 
i solved it by removing useother=f and appending limit=x to the end of the chart command where x is the number of columns i want to display ->
Solved: Why do I only see 10 results/columns in my count t... - Splunk Community

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @sophiacyh,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

0 Karma
Get Updates on the Splunk Community!

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...