splunk 4.3 - searchPostProcess on chart component not working

[chusi]

After upgrading to 4.3 our custom forms with a chart component started to show up the following error:

Search did not generate any statistical results. 

The table and event component still works with the searchPostProcess statement as expected, only the chart fails.

The following is some example code which fails in splunk 4.3 but worked before.

<form>
  <searchTemplate>index=*</searchTemplate>
  <label>Test PostProcess</label>
  <fieldset>
    <input type="time" />
  </fieldset>

 <row>
  <chart>
      <title>Test Chart</title>
      <searchPostProcess>timechart count</searchPostProcess>
      <option name="charting.chart">column</option>
  </chart>
</row>
</form>

If i do the the same search directly in the chart component, it works as expected...

<form>
  <!--<searchTemplate>index=*</searchTemplate>-->
  <label>Test PostProcess</label>
  <fieldset>
      <input type="time" />
  </fieldset>

    <row>
      <chart>
          <title>Test Chart</title>
          <searchTemplate>index=* | timechart count</searchTemplate>
          <option name="charting.chart">column</option>
      </chart>

  </row>
  </form>     

somebody having the same problem? or even know a solution?

[rruijgrok]

The above answer by Simon only works if the view is displaying graphs only and each event contains the same fields.
My view displays graphs, tables and events based upon 1 base search and events do not necessarily have the same fields.

Also I do not want aggregation or statistics in the base search, as it kills the event display.

[Simon_Fishel]

This is a bug in the new non-Flash charting module. It crops up when the base search of a post-process operation is not itself a reporting search. We're tracking the issue and it will likely be fixed soon.

In the meantime, if you don't want to switch the chart to Flash, you can also work around it by making the base search a reporting search (which is recommended practice anyway). Check out the docs for a full explanation, the gist is that you'll need to add a reporting command in the base search that includes all of the fields that are being used downstream.

[Simon_Fishel]

This configuration should now work with the JSChart module in 4.3.1

[rruijgrok · Accepted solution]

Had the same problem.
The fix described in this post link text

worked for me.
Just add <option name="charting.scaleX">1</option> to the chart.

Also found that not all fields were available for searchPostProcess (the fields extracted at search time)
Fixed that by adding '| field + *' in the searchTemplate.

[swdonline]

Disregard. I had to change "splitSeries" to false. Worked great. Thanks!

[swdonline]

That got the chart showing again, but with sparklines. It's no longer honoring stackmode: "stacked"

[chusi]

great! that totally fixed it! thank you very much!

[swdonline]

Same problem here...

   <form>

   <label>Class Miner v2.0</label>

    <searchTemplate>index="*" | fillnull value=NULL | search $name$ $class$ $grade$</searchTemplate>

    <fieldset>

        <input type="dropdown" token="name">
            <populatingSearch fieldForValue="name" fieldForLabel="name"><![CDATA[index="summary_names" | fields
 name | dedup name | sort name ]]></populatingSearch>
            <prefix>name="</prefix>
            <suffix>"</suffix>
            <choice value="*">Any</choice>
            <default>Any</default>
        </input>

        <input type="dropdown" token="class">
            <prefix>class="</prefix>
            <suffix>"</suffix>
            <choice value="*">Any</choice>
            <choice value="CS">CompSci</choice>
            <choice value="EN">English</choice>
            <choice value="HI">History</choice>
            <choice value="MA">Math</choice>
            <default>Any</default>
        </input>

        <input type="dropdown" token="grade">
            <populatingSearch fieldForValue="grade" fieldForLabel="grade"><![CDATA[index="summary_grades" | fields grade | dedup grade | sort grade]]></populatingSearch>
            <prefix>grade="</prefix>
            <suffix>"</suffix>
            <choice value="*">Any</choice>
            <default>Any</default>
        </input>
    </fieldset>
    <row>
        <chart>
            <title>Grades By Class</title>
            <searchPostProcess>search class!="Unknown"| timechart count by class</searchPostProcess> 
            <option name="charting.chart">area</option>
            <option name="charting.legend.placement">right</option>
            <option name="charting.chart.stackMode">stacked</option>
            <option name="charting.layout.splitSeries">True</option>
        </chart>
   </row>
</form>