Could you attach the .json file for the data model you're working with? If it's shared at the app level, you should be able to find it at /etc/apps/ /local/data/models/ .json
... View more
Agreed, there is most likely a bug in the pivot interface that's causing this. Hopefully we can track down the root cause so we can provide you with a workaround until we figure out a proper fix from our end.
... View more
@martin_mueller, I downloaded a fresh version of Splunk 6 and tried to recreate your screenshot (including using the "de-DE" locale). For me, the time range was handled correctly. Do you have any customizations around search time ranges on your system?
... View more
Unfortunately the contents of the "Values" drop-down is not configurable at the moment, though it's likely we will be adding more options for each data type in future releases.
In the meantime, one workaround you can try is to create a new Eval attribute that you just set equal to the original numeric attribute, but make the new attribute a string. Then in pivot you should be able do numeric operations on one and string operations on the other.
... View more
I think you can just pass it as an option to the chart constructor:
var ChartView = require("splunkjs/mvc/chartview");
new ChartView({
id: "example-chart",
managerid: "example-search",
type: "line",
el: $("#mychart"),
"charting.legend.placement": "bottom"
}).render();
Or set it after the chart has been created:
splunkjs.mvc.Components.getInstance("example-chart").settings.set({
"charting.legend.placement": "bottom",
});
... View more
@bruceclarke, we haven't been able to reproduce the issue internally yet. If you don't mind providing the info I requested from the original poster, it would help a lot.
... View more
And how are you extracting the boolean attribute? I think it has to have a value of either the string "true" or the string "false". In my case I'm using an Eval and the expression looks like this:
if(sourcetype == "foo", "true", "false")
... View more
Interesting, I'm not able to reproduce the issue on my own, either with a sample data model or one I created myself. So it sounds like it's specific either to your data set or the way your data model is configured.
Would you be willing to attach some of your configuration files so I can try out your data model on my system? I think I would need:
some sample data
props.conf
transforms.conf
the data model .json file (which should be in <splunk root>/etc/apps/<your app>/local/data/models)
... View more
What is the data source for your Data Model? Is the object you're pivoting on Event-based or Transaction-based? And have you accelerated the Data Model?
... View more
from the page where you're viewing the report, select Edit -> Open In Search
once you land in Search, click Save (if it's greyed out you may have to make a meaningless change)
in the dialog that comes up, select "None" for "Visualization" and save it
... View more
If I'm understanding you correctly, you'd like a timechart of how many messages you are receiving over time. If so, try this:
host=host1 sourcetype="Perfmon:MSMQ Queue" instance="instance2" OR instance="instance1" | timechart count
... View more
This sounds like a bug, would it be possible for you to post a screenshot? And what version of Splunk are you using?
In the meantime, there are a couple of potential work-arounds. If your data is all very small numbers, you could set an explicit minimum/maximum/interval for the y-axis. You could also try setting the y-axis to log scale.
... View more
For your timechart, this should do the trick, you can control the time range using the time range picker in the UI:
index=yourindex sourcetype=yoursourcetype ... | timechart avg(resources_used.ncpus) as "resources_used.ncpus"
For the scatter chart, try this:
index=yourindex sourcetype=yoursourcetype ... | table resources_used.ncpus resources_used.walltime
... View more
Could you provide a little more information on the steps that lead you to this error. Is this a brand new pivot report, or are you re-opening one that you saved earlier?
This might be a permissioning issue, try making the Tutorial data model globally visible.
... View more
Based on your original error message, it looks like your dashboard is trying to use a data model called Tutorial, not Buttercope. The Tutorial data model is the one that needs to be changed from private to global.
... View more
This could be a permission issue. Make sure that the user and app combination you are using to view the dashboard has read access to the Tutorial data model.
... View more