chart command field only displayed when i add a filter

[sophiacyh]

Hello Splunk Community!

I have a query where im extracting data from different logs and displaying them on the same row in a statistical table.

here is my code:

index=main source=/opt/server/*/*userauth* 
| rex field=_raw "\]\s\S+\s-\s\[(?<caller>\S+)\]\s\S+->(?<function>\S+)\s(?<logs>.+)\:\s\[(?<value>\S+)\]" 
| where isnotnull(caller) 
| chart values(value) over caller by logs useother=f

i used the chart command to turn the logs  into column headers with their respective values

The result :

caller	logB	logC	logD
caller_id	valueB	valueC	valueD

however, when i narrow down the search by adding "validateSB" which is contained in most log entries,

index=main source=/opt/server/*/*userauth* validateSB
| rex field=_raw "\]\s\S+\s-\s\[(?<caller>\S+)\]\s\S+->(?<function>\S+)\s(?<logs>.+)\:\s\[(?<value>\S+)\]" 
| where isnotnull(caller) 
| chart values(value) over caller by logs useother=f

 The column A now appears as a column header with its respective value.

caller	logA	logB	logC	logD
caller_id	valueA	valueB	valueC	valueD

When i also search a specific caller, the column A appears with its respective value too.

Anybody know why this might be the case?

Thanks in advance!

[gcusello · Accepted solution]

Hi @sophiacyh,

probably you have few values that in the main search aren't displayed, instead when you add the additional field, the percentage of that value is greater so it's displayed in the chart command.

If you see at https://docs.splunk.com/Documentation/Splunk/8.2.6/SearchReference/Chart the default value for the "limit" option is 10, you could add a greater value for this option, but obviously in this way you'll have much many columns.

As I said, you could change the value for the limit option, or eventually think your search in two steps:

a first panel with all values, andd, with a click on one row, a drilldown adding an additional filter.

Ciao.

Giuseppe

[sophiacyh]

Thank you ! @gcusello 
i solved it by removing useother=f and appending limit=x to the end of the chart command where x is the number of columns i want to display ->
Solved: Why do I only see 10 results/columns in my count t... - Splunk Community

[gcusello]

Hi @sophiacyh,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉