Hi, I am still not able to find the solution. Can anyone please help? ... View more

Hi, It is still not working. I have another configuration for another field in the app. That is also multiline event. But for that we are getting the data in events. Details of that field are as below: Ouput of shell script: [root@splunkitsi bin]$ ./vmstat.sh memTotalMB memFreeMB memUsedMB memFreePct memUsedPct pgPageOut swapUsedPct pgSwapOut cSwitches interrupts forks processes threads loadAvg1mi 12863 12122 741 94.2 5.8 338955619 0.9 12696 2302182698 3016592159 15420967 130 407 1.08 Content of Transforms.conf #memTotalMB memFreeMB memUsedMB memFreePct memUsedPct pgPageOut swapUsedPct pgSwapOut cSwitches interrupts forks processes threads loadAvg1mi # 8192 4153 4039 50.7 49.3 1585619 5.0 ? ? ? ? 82 566 0.72 [fields_for_vmstat_sh] REGEX = \s+([0-9.?]+)\s+([0-9.?]+)\s+([0-9.?]+)\s+([0-9.?]+)\s+([0-9.?]+)\s+([0-9.?]+)\s+([0-9.?]+)\s+([0-9.?]+)\s+([0-9.?]+)\s+([0-9.?]+)\s+([0-9.?]+)\s+([0-9.?]+)\s+([0-9.?]+)\s+([0-9.?]+) FORMAT = memTotalMB::"$1" memFreeMB::"$2" memUsedMB::"$3" memFreePct::"$4" memUsedPct::"$5" pgPageOut::"$6" swapUsedPct::"$7" pgSwapOut::"$8" cSwitches::"$9" interrupts::"$10" forks::"$11" processes::"$12" threads::"$13" loadAvg1mi::"$14" Contents of Props.conf [vmstat] LINE_BREAKER=(^$|[\r\n]+[\r\n]+) TRUNCATE=1000000 DATETIME_CONFIG = CURRENT REPORT-0kv_for_vmstat = fields_for_vmstat_sh,vmstat_linux,vmstat_osx FIELDALIAS-dest_for_vmstat = host as dest EVAL-mem = if(isnotnull(memFreeMB) AND isnotnull(memUsedMB),(memFreeMB*1048576)+(memUsedMB*1048576),null()) EVAL-mem_free = if(isnotnull(memFreeMB),memFreeMB*1048576,null()) EVAL-mem_used = if(isnotnull(memUsedMB),memUsedMB*1048576,null()) FIELDALIAS-src_for_vmstat = host as src Event output in Search query: ... View more

Hi Please check the output as shown in image: ... View more

Hi, Tried changing REGEX and FORMAT as you specified. But still no change. The values are still 0. ... View more

Hi but when we try to login using http://www.splunk.com/r/bugs url, it shows below error: ... View more

Hey Thanks! That solved my issue. By adding submitButton="true" in fieldset, got the post process to work. If you find the reason why that is required, please let me know. ... View more

Thanks Lavanya. That data limitation is only when post-process is search on non-transforming base search. In my case, I have used stats command in base search which transforms the data and so there should be no data limitation in post-process search. Also my csv contains only 2 records and only one distinct artist name so data must not be the issue. ... View more

Hi, The data is not the issue, the issue is my dropdown is not accepting base search as I have done in my first post. It is expecting full search query. ... View more

Hi, Actually I want the dropdown with distinct artist_names from the output of basesearch. The above solution will populate dropdown with single item as "R*" ... View more

Hi, It is a Xml Parsing bug as I found out. After trying many combinations and comparisons, found the issue is in XML parsing of chart-count-over-by-clause. When there there a newline after chart-count-over-by-clause and there is TAB character before the ending `` tag in the next line as below, the chart shows the error as mentioned by me. NOT WORKING: <query> regex bc_uri="/browse/tracks/*" | chart count over artist_name by track_name limit=100 </query> But when you remove that TAB character in that line, the chart shows no error and works absolutely fine as below. WORKING <search base="baseSearch"> <query> chart count over track_name by artist_name </query> Please raise a bug for the same. ... View more

Hey, I have same version splunk 6.2.4 When I created music2.csv with those two records and copied whole of your Dashboard content above in my xml. It worked like charm. That's what made me curious and I tried more than 50 combination tests and comparisons on my original xml and your xml content above and to your surprise I found where the issue was. I am unable to add an answer so check by answer in woodcock's post. Thanks ... View more

Do you mean to say that if my basesearch contains only "host="MusicData" artist_name=*" and my chart's search contains "chart count over artist_name by track_name limit=100" then it should work? I tried that but it is not working. As you suggested my data may have the issue, I tried to manipulate it in base search as below: host="MusicData" index=ishanappindex NOT (artist_name="artist_name") | fillnull value=Others artist_name,track_name| replace "" with "Others" in artist_name,track_name| dedup artist_name track_name| Where artist_name="Rihanna" | table artist_name track_name Above base search gave results like below (exported search results in csv): "artist_name","track_name" Rihanna,"You Da One" Rihanna,"We Found Love" Here we sure that data is correct, but still the Chart 1 with count-over-by clause gives the same error. So it turns out that it is neither data issue nor regex issue. ... View more

Hi, Thank You! Where can I track the support case for this? Any Url? ... View more

Hi, But if regex is an issue, then suppose I don't want any regex filter and I generate the chart with data generated by base search as below: <chart> <title>Chart 1 - Not Working</title> <search base="baseSearch"> <query> chart count over artist_name by track_name limit=100 </query> </search> <option name="charting.chart">column</option> <option name="charting.chart.stackMode">stacked</option> </chart> Still the error remains the same. So I mean to say it is not related to regex. ... View more

Hi Mus, When I click on search for this column chart, it searches with final query as below so the chart generated properly in Search's Visualization Tab: host="MusicData" | table artist_name bc_uri track_name | regex bc_uri="/browse/tracks/*" | chart count over artist_name by track_name limit=100 Then I tried to replicate the error by creating a saved search and using it in search tab as below: |savedsearch testsavedsearch | chart count over artist_name by track_name limit=100 Still it worked fine. So the issue is coming only inside a dashboard panel chart. Do you still want a Job Inspector log? Search Query is searching from below sample data: "_time","artist_name",eventtype,"search_terms","bc_uri","track_name" "1360368808.948083",,"ua-mobile-ipad",LMFAO,"/browse/search/LMFAO", "1360368808.945860",,"ua-mobile-android",,"/ads/showbanner", "1360368808.939115",,"ua-mobile-iphone",,"/sync/createplaylist", "1360368806.935405",,"ua-mobile-android",,"/browse/home", "1360368806.886419",Rihanna,"ua-mobile-blackberry",,"/browse/tracks/01011207201000005652000000000049","You Da One" "1360368806.868352",,"ua-mobile-android",,"/auth/5558899235", "1360368805.956702",,"ua-mobile-blackberry",,"/ads/showbanner", "1360368805.937359","Toby Keith","ua-mobile-blackberry",,"/browse/tracks/01011207201000005652000000000083","Red Solo Cup" "1360368805.919084",,"ua-mobile-android",,"/browse/artist/0026", "1360368805.917081",,"ua-mobile-ipad",,"/sync/createplaylist", ... View more