Reporting

Pivot Error In handler 'datamodelreport': Pivot Error in buildSearchWithModel: error building non-tstats searchString

rjain15
Explorer

I am building a data model and it is a simple Visitor data model, with attributes of the Visitor like Country, IP Address etc.

When I create a Pivot and do a Split rows or columns by any attribute, like Country I get this error

In handler 'datamodelreport': Pivot Error in buildSearchWithModel: error building non-tstats searchString

What am I doing wrong, or do I have to create the attribute types to some thing which I can split?

I have the data (count) returned at 12,000 events for today.

Interestingly, I have an attribute "User Name" which I can create split. But none of the other attributes. All attributes are auto extracted.

Thanks,
Rajesh

seanbrhn3
Explorer

Hi I am new to splunk and I am currently facing the same problem. So my question is what is a base search is it a root search within or something else?

0 Karma

rjain15
Explorer

Hi Archana

Yes the fields have spaces in them. If I create a datamodel with Base Search and rename the fields, it works. But I create the same model using events, and rename the fields it doesn;t work.

Here is a raw event: As you can see the dimensions.Country of Visits has spaces in it. If I rename it as "dimensions.Country of Visits" as Country in the Base Search and then creating a Search Object works.

But just renaming it in the Object Time of Event doesn't work.

{"name":"Detailed Visit Data","application":"easyTravel portal","type":"VISIT","startTime":"2013-11-04 14:56:08.962-0500","endTime":"2013-11-04 14:56:29.98-0500","dimensions":{"Client Type of Visits":"Synthetic Agent","Client Family of Visits":"Gomez Agent","Country of Visits":"Japan","Landing Page of Visits":"\u0027easyTravel - One step to happiness\u0027","Operating System of Visits":"unknown","User Experience Index of Visits":"satisfied","Client IP Address of Visit":"60.238.151.3","Client of Visits":"Gomez Agent","Connection Type of Visits":"DSL medium (768 kb/s)","Exit Page of Visits":"\u0027easyTravel - Contact\u0027"},"measures":{"Visit Count":1.0,"Action Count":3.0,"Failed Actions Count":0.0,"Bounce Rate":0.0},"visitId":4082344,"apdex":1.0,"converted":false}

0 Karma

Archana
Splunk Employee
Splunk Employee

What's the best way for us to take a look at your data model? e.g. are there fields with spaces in fieldname?

0 Karma

rjain15
Explorer

I see the following in the splunkd.log

There is no python.log file

Is there are way to get some more meaningful info on what is happening in the front end -- like a search string which is being built by Pivot.

10-15-2013 10:43:28.917 -0400 ERROR AdminManager - Pivot Error in buildSearchWithModel: error building non-tstats searchString
10-15-2013 10:43:34.467 -0400 WARN DispatchSearch - Unable to save search history for user=nobody, app=CompuwareAPM, sid=1381848214.6398, search='| tstats count AS "Count of Visit" from sid=1381848117.6375 prestats=true | stats count AS "Count of Visit" | fields , "Count of Visit"| fillnull "Count of Visit"'
10-15-2013 10:43:44.953 -0400 WARN DispatchSearch - Unable to save search history for user=nobody, app=CompuwareAPM, sid=1381848224.6400, search='| tstats dc("Visit.converted") AS "Distinct Count of converted" from sid=1381848117.6375 prestats=true | stats dc("Visit.converted") AS "Distinct Count of converted" | fields , "Distinct Count of converted"| fillnull "Distinct Count of converted"'
10-15-2013 10:44:03.077 -0400 ERROR AdminManager - Pivot Error in buildSearchWithModel: error building non-tstats searchString
10-15-2013 10:44:41.964 -0400 WARN DispatchSearch - Unable to save search history for user=nobody, app=CompuwareAPM, sid=1381848281.6402, search='| tstats count AS "Count of Visit" from sid=1381848117.6375 prestats=true | stats count AS "Count of Visit" | fields , "Count of Visit"| fillnull "Count of Visit"'

0 Karma

Archana
Splunk Employee
Splunk Employee

Is there a stack trace var/log/splunk/python.log with more details? Thanks!

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...