After saving my search as a report on the dashboard, why is the chart data incomplete?

[kotig]

We have data like this:

TestPath                   200  202  500  302
/test/v1                   51   0   0   0
/test/v1/p1/test1/test   0  1   0   0
/test/v1/p1/test1/test1 0   0   8   0
/test/v1/p1/test1/test2 1   0   0   0

My search shows the data correctly and I see the visualization displays the chart properly, but when I convert that to a report and save it on the dashboard, it shows only 1 record which has data for 500 which is 8 records.

What might be the issue? Attached the images of how the data is shown on search/visualization chart and on the dashboard.

I tried on all kinds of browsers and its the same issue. Any help on what might be the issue would be appreciated.

[somesoni2 · Accepted solution]

Give this a try

index=logdatafile earliest=-3d | rex field=_raw "(?msi)(?\{.+\}$)" | spath input=json_field | table success.successcode,success.path,fault.errorcode,fault.path,fault.errorStatusCode | eval ResponseCode=coalesce('success.successcode', 'fault.errorcode' ,'fault.errorStatusCode') |where isnotnull(ResponseCode) | eval Path=coalesce('success.path','fault.path') | chart count by ResponseCode,Path

[kotig]

This worked. Thank you for your inputs.

[Richfez]

How do you specify the time frame of the search?

[kotig]

i am specifying the time frame as earliest=-3d, below is how my query looks..

index=logdatafile earliest=-3d | rex field=_raw "(?msi)(?\{.+\}$)" | spath input=json_field | table success.successcode,success.path,fault.errorcode,fault.path,fault.errorStatusCode | rename success.successcode as ResponseCode | rename fault.errorcode as ResponseCode|rename fault.errorStatusCode as ResponseCode| rename success.path as Path | rename fault.path as Path|where isnotnull(ResponseCode)| chart count by ResponseCode,Path