Splunk Search

Getting error "Error in 'chart' command: The argument ' ' is invalid." when using "chart-count-over-by" clause in chart with post-process search

Explorer

Hi,

In my dashboard I have a base search and three charts as below:

<dashboard>
  <search id="baseSearch">
    <query>
      host="MusicData" | table artist_name bc_uri track_name
    </query>
  </search>
  <row>
    <panel>
      <chart>
    <title>Chart 1 - Not Working</title>
        <search base="baseSearch">
          <query>
        regex bc_uri="/browse/tracks/*" | chart count over artist_name by track_name limit=100
      </query>
        </search>
        <option name="charting.chart">column</option>
    <option name="charting.chart.stackMode">stacked</option>
      </chart>
    </panel>
    <panel>
      <chart>
    <title>Chart 2 - Working</title>
        <search>
          <query>
        host="MusicData" | table artist_name bc_uri track_name | regex bc_uri="/browse/tracks/*" | chart count over artist_name by track_name limit=100
      </query>
        </search>
        <option name="charting.chart">column</option>
    <option name="charting.chart.stackMode">stacked</option>
      </chart>
    </panel>
    <panel>
      <chart>
    <title>Chart 3 - Working</title>
    <search base="baseSearch">
          <query>
        regex bc_uri="/browse/tracks/*" | chart count(track_name) by artist_name
          </query>
        </search>
        <option name="charting.chart">pie</option>
      </chart>
    </panel>
  </row>
</dashboard>

From the above three charts,
Chart 1 - gives me error as it uses Chart Count Over By in Post Process Search
Chart 2 - Works fine as it is regular search with same final query
Chart 3 - Works fine with Post Process Search but it does not use Chart Count Over By clause.

So what is the reason, Over By clause is not working in Post Process Search?

Final Dashboard View:

alt text

0 Karma

Explorer

Hi,

It is a Xml Parsing bug as I found out.

After trying many combinations and comparisons, found the issue is in XML parsing of chart-count-over-by-clause.
When there there a newline after chart-count-over-by-clause and there is TAB character before the ending `` tag in the next line as below, the chart shows the error as mentioned by me.

NOT WORKING:

              <query>
            regex bc_uri="/browse/tracks/*" | chart count over artist_name by track_name limit=100
        </query>

But when you remove that TAB character in that line, the chart shows no error and works absolutely fine as below.

WORKING

      <search base="baseSearch">
            <query>
           chart count over track_name by artist_name                   
</query>

Please raise a bug for the same.

SplunkTrust
SplunkTrust

hmm, why adding a tab anyway? If you use the simple XML editor the closing tag will match the opening tag.
As mentioned before, Bugs must be filed here http://www.splunk.com/r/bugs

0 Karma

Builder

Some code editors automatically indent with tabs, and it is not unusual to add whitespace within a search tag for readability on a long search. It is silly that Splunk can handle spaces but not tabs within tags. I have already reported this as a bug and I hope it is fixed in 6.3.

0 Karma

SplunkTrust
SplunkTrust

Hi ishangajera,

This is no bug or no support case worthy problem. I used your provided examples and your dashboard and it works like a charm.

alt text
It more looks like some strange line in the event data that breaks the regex. Instead of using the regex command to remove the unwanted line, simply use artist_name=* in your base search like this host="MusicData" artist_name=* and it will get you the same result.

Give it a try and report back.

cheers, MuS

Explorer

Hi,

But if regex is an issue, then suppose I don't want any regex filter and I generate the chart with data generated by base search as below:

      <chart>
    <title>Chart 1 - Not Working</title>
        <search base="baseSearch">
          <query>
         chart count over artist_name by track_name limit=100
      </query>
        </search>
        <option name="charting.chart">column</option>
    <option name="charting.chart.stackMode">stacked</option>
      </chart>

Still the error remains the same. So I mean to say it is not related to regex.

0 Karma

SplunkTrust
SplunkTrust

Okay, probably I wasn't too clear. The problem is most likely within your data. The provided sample works in a adapted search like this host="MusicData" artist_name=* | chart count over artist_name by track_name limit=100 but I assume the error or breaking event is somewhere else.
If you're willing and if it's possible to provide a complete set of the _raw events, I will contact you and will have a closer look on this.

Explorer

Do you mean to say that if my basesearch contains only "host="MusicData" artist_name=*" and my chart's search contains "chart count over artist_name by track_name limit=100" then it should work? I tried that but it is not working.

As you suggested my data may have the issue, I tried to manipulate it in base search as below:

host="MusicData" index=ishanappindex NOT (artist_name="artist_name")  | fillnull value=Others artist_name,track_name| replace "" with "Others" in artist_name,track_name| dedup artist_name track_name| Where artist_name="Rihanna" | table artist_name track_name

Above base search gave results like below (exported search results in csv):

"artist_name","track_name"
Rihanna,"You Da One"
Rihanna,"We Found Love"

Here we sure that data is correct, but still the Chart 1 with count-over-by clause gives the same error.
So it turns out that it is neither data issue nor regex issue.

0 Karma

SplunkTrust
SplunkTrust

What version of Splunk you're on? In 6.2.4 this works like a charm. Using your example:

"artist_name","track_name"
 Rihanna,"You Da One"
 Rihanna,"We Found Love"

as music2.csv and a dashboard like this :

<dashboard>
   <search id="baseSearch">
     <query>
       | inputlookup music2.csv | search artist_name=* | table artist_name bc_uri track_name
     </query>
   </search>
   <row>
     <panel>
       <chart>
     <title>Chart 1 - Not Working</title>
         <search base="baseSearch">
           <query>
          chart count over artist_name by track_name limit=100
       </query>
         </search>
         <option name="charting.chart">column</option>
     <option name="charting.chart.stackMode">stacked</option>
       </chart>
     </panel>
     <panel>
       <chart>
     <title>Chart 2 - Working</title>
         <search>
           <query>
         | inputlookup music2.csv | search artist_name=* | table artist_name bc_uri track_name | chart count over artist_name by track_name limit=100
       </query>
         </search>
         <option name="charting.chart">column</option>
     <option name="charting.chart.stackMode">stacked</option>
       </chart>
     </panel>
     <panel>
       <chart>
     <title>Chart 3 - Working</title>
     <search base="baseSearch">
           <query>
          chart count(track_name) by artist_name
           </query>
         </search>
         <option name="charting.chart">pie</option>
       </chart>
     </panel>
   </row>
 </dashboard>

If you still think it's a bug, feel free to open one at http://www.splunk.com/r/bugs

Explorer

Hey,

I have same version splunk 6.2.4

When I created music2.csv with those two records and copied whole of your Dashboard content above in my xml. It worked like charm.

That's what made me curious and I tried more than 50 combination tests and comparisons on my original xml and your xml content above and to your surprise I found where the issue was.

I am unable to add an answer so check by answer in woodcock's post.

Thanks

0 Karma

SplunkTrust
SplunkTrust

Hi ishangajera,

what does the job inspector for this search chart 1 report? Could you provide some sample events?

0 Karma

Explorer

Hi Mus,

When I click on search for this column chart, it searches with final query as below so the chart generated properly in Search's Visualization Tab:

host="MusicData" | table artist_name bc_uri track_name |        regex bc_uri="/browse/tracks/*" | chart count over artist_name by track_name limit=100    

Then I tried to replicate the error by creating a saved search and using it in search tab as below:

|savedsearch testsavedsearch | chart count over artist_name by track_name limit=100

Still it worked fine. So the issue is coming only inside a dashboard panel chart. Do you still want a Job Inspector log?

Search Query is searching from below sample data:

"_time","artist_name",eventtype,"search_terms","bc_uri","track_name"
"1360368808.948083",,"ua-mobile-ipad",LMFAO,"/browse/search/LMFAO",
"1360368808.945860",,"ua-mobile-android",,"/ads/showbanner",
"1360368808.939115",,"ua-mobile-iphone",,"/sync/createplaylist",
"1360368806.935405",,"ua-mobile-android",,"/browse/home",
"1360368806.886419",Rihanna,"ua-mobile-blackberry",,"/browse/tracks/01011207201000005652000000000049","You Da One"
"1360368806.868352",,"ua-mobile-android",,"/auth/5558899235",
"1360368805.956702",,"ua-mobile-blackberry",,"/ads/showbanner",
"1360368805.937359","Toby Keith","ua-mobile-blackberry",,"/browse/tracks/01011207201000005652000000000083","Red Solo Cup"
"1360368805.919084",,"ua-mobile-android",,"/browse/artist/0026",
"1360368805.917081",,"ua-mobile-ipad",,"/sync/createplaylist",
0 Karma

Esteemed Legend

This looks like a bug to me, I would definitely open a support case.

0 Karma

Explorer

Hi,

Thank You!

Where can I track the support case for this? Any Url?

0 Karma