Splunk Search

Null results on timechart using base search

3DGjos
Communicator

Hello, im making a dashboard with a timechart and some filters, I can't make it to work, my filter gives no results and my linechart shows only a weird count of NULLS. Weird thing is that, if I click on "open in search", my search works.

Here are my inputs:

<search id="base1">
    <query>index=XXX ("XXXCreateEmptyGame: GameInfo:") action=created  game!=*XX* 
         </query>
 <earliest>$time.earliest$</earliest>
    <latest>$time.latest$</latest>
  </search>  

<input type="time" token="time" searchWhenChanged="true">
        <label>time</label>
        <default>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </default>
      </input>

      <input type="multiselect" token="character" searchWhenChanged="true">
        <label>Filtrar by char</label>
        <choice value="*">TODOS</choice>
        <initialValue>*</initialValue>
        <valuePrefix>character="</valuePrefix>
        <valueSuffix>"</valueSuffix>
        <delimiter> OR </delimiter>
        <search base="base1">
          <query>  stats      count(action) AS "countx" by character  |head 10| sort - "countx" | fields - "countx"</query>
        </search>
      </input>
      <chart>
        <title>total amount</title>
        <search base="base1">
          <query>timechart  span=1h useother=f count(action) AS "count2" by character  | sort - "count2"</query>
        </search>
        <option name="charting.chart">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.showDataLabels">all</option>
        <option name="charting.drilldown">none</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="refresh.display">progressbar</option>
      </chart>
    </panel>
  </row>

Any help is welcome, thanks!

0 Karma
1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust

@3DGjos

Try by mentioning required fields only in base search.

like

index=XXX ("XXXCreateEmptyGame: GameInfo:") action=created  game!=*XX* | table _time action character  

OR

index=XXX ("XXXCreateEmptyGame: GameInfo:") action=created  game!=*XX* | fields _time action character  

View solution in original post

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@3DGjos

Try by mentioning required fields only in base search.

like

index=XXX ("XXXCreateEmptyGame: GameInfo:") action=created  game!=*XX* | table _time action character  

OR

index=XXX ("XXXCreateEmptyGame: GameInfo:") action=created  game!=*XX* | fields _time action character  
0 Karma

3DGjos
Communicator

Can't mark it as the answer :S

0 Karma

MuS
Legend

you could also just use timechart span=1h useother=f count(action) AS "count2" by character usenull=f but to limit or filter on the fields in the base search is much better 😉

cheers, MuS

0 Karma

3DGjos
Communicator

Thanks! it worked!

0 Karma
Get Updates on the Splunk Community!

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...