Pivot Error In handler 'datamodelreport': Pivot Error in buildSearchWithModel: error building non-tstats searchString

[rjain15]

I am building a data model and it is a simple Visitor data model, with attributes of the Visitor like Country, IP Address etc.

When I create a Pivot and do a Split rows or columns by any attribute, like Country I get this error

In handler 'datamodelreport': Pivot Error in buildSearchWithModel: error building non-tstats searchString

What am I doing wrong, or do I have to create the attribute types to some thing which I can split?

I have the data (count) returned at 12,000 events for today.

Interestingly, I have an attribute "User Name" which I can create split. But none of the other attributes. All attributes are auto extracted.

Thanks,
Rajesh

[seanbrhn3]

Hi I am new to splunk and I am currently facing the same problem. So my question is what is a base search is it a root search within or something else?

[rjain15]

Hi Archana

Yes the fields have spaces in them. If I create a datamodel with Base Search and rename the fields, it works. But I create the same model using events, and rename the fields it doesn;t work.

Here is a raw event: As you can see the dimensions.Country of Visits has spaces in it. If I rename it as "dimensions.Country of Visits" as Country in the Base Search and then creating a Search Object works.

But just renaming it in the Object Time of Event doesn't work.

{"name":"Detailed Visit Data","application":"easyTravel portal","type":"VISIT","startTime":"2013-11-04 14:56:08.962-0500","endTime":"2013-11-04 14:56:29.98-0500","dimensions":{"Client Type of Visits":"Synthetic Agent","Client Family of Visits":"Gomez Agent","Country of Visits":"Japan","Landing Page of Visits":"\u0027easyTravel - One step to happiness\u0027","Operating System of Visits":"unknown","User Experience Index of Visits":"satisfied","Client IP Address of Visit":"60.238.151.3","Client of Visits":"Gomez Agent","Connection Type of Visits":"DSL medium (768 kb/s)","Exit Page of Visits":"\u0027easyTravel - Contact\u0027"},"measures":{"Visit Count":1.0,"Action Count":3.0,"Failed Actions Count":0.0,"Bounce Rate":0.0},"visitId":4082344,"apdex":1.0,"converted":false}

[Archana]

What's the best way for us to take a look at your data model? e.g. are there fields with spaces in fieldname?

[rjain15]

I see the following in the splunkd.log

There is no python.log file

Is there are way to get some more meaningful info on what is happening in the front end -- like a search string which is being built by Pivot.

10-15-2013 10:43:28.917 -0400 ERROR AdminManager - Pivot Error in buildSearchWithModel: error building non-tstats searchString
10-15-2013 10:43:34.467 -0400 WARN DispatchSearch - Unable to save search history for user=nobody, app=CompuwareAPM, sid=1381848214.6398, search='| tstats count AS "Count of Visit" from sid=1381848117.6375 prestats=true | stats count AS "Count of Visit" | fields , "Count of Visit"| fillnull "Count of Visit"'
10-15-2013 10:43:44.953 -0400 WARN DispatchSearch - Unable to save search history for user=nobody, app=CompuwareAPM, sid=1381848224.6400, search='| tstats dc("Visit.converted") AS "Distinct Count of converted" from sid=1381848117.6375 prestats=true | stats dc("Visit.converted") AS "Distinct Count of converted" | fields , "Distinct Count of converted"| fillnull "Distinct Count of converted"'
10-15-2013 10:44:03.077 -0400 ERROR AdminManager - Pivot Error in buildSearchWithModel: error building non-tstats searchString
10-15-2013 10:44:41.964 -0400 WARN DispatchSearch - Unable to save search history for user=nobody, app=CompuwareAPM, sid=1381848281.6402, search='| tstats count AS "Count of Visit" from sid=1381848117.6375 prestats=true | stats count AS "Count of Visit" | fields , "Count of Visit"| fillnull "Count of Visit"'

[Archana]

Is there a stack trace var/log/splunk/python.log with more details? Thanks!