I have created a dashboard with the base search as shown below.Bana Chart
The base search is applied correctly on single panel but in chart panel the base search does not seem to work. The chart panel always shows no result found. But if I give the query directly instead of referencing to base search then the chart panel also works fine.
How do I make sure that chart panel uses the base search?
<search id="base_search_app">
<query>index=something | table msg,timestamp</query>
<earliest>$time.earliest$</earliest>
<latest>$time.latest$</latest>
</search>
<fieldset submitButton="true" autoRun="true">
<input type="time" token="time">
<label>Time Picker</label>
<default>
<earliest>-15m</earliest>
<latest>now</latest>
</default>
</input>
</fieldset>
<row>
<panel>
<single>
<title>Total created</title>
<search base="base_search_app">
<query>| where like(msg, "%Invoked service%") | stats count</query>
</search>
<option name="colorMode">block</option>
<option name="drilldown">none</option>
<option name="rangeColors">["0x53a051","0x0877a6","0xf8be34","0xf1813f","0x006d9c"]</option>
<option name="underLabel">No idea when to use this</option>
<option name="useColors">1</option>
</single>
</panel>
</row>
<row>
<panel>
<chart>
<title>Customer response timeline</title>
<search base="base_search_app">
<query>| search msg="*something*" OR msg="*somethingelse*" | timechart count</query>
</search>
<option name="charting.chart">line</option>
<option name="charting.drilldown">none</option>
<option name="height">558</option>
<option name="refresh.display">progressbar</option>
</chart>
</panel>
</row>
In your XML configuration, it looks like you are using the correct approach to reference the base search for the chart panel. However, there might be an issue with the search query itself or the data that is being returned from the base search.
Here are some things to check and potential solutions:
-
Verify the Search Query: Make sure that the search query inside the chart panel's
<search>element is correct and returns data. You can test the query separately in Splunk to ensure it produces the desired results. -
Check for Data: Ensure that there is data available in the selected index (
index=something) for the specified time range (earliesttolatest). If there is no data available, the chart panel will show "No results found." -
Use
searchCommand: In the chart panel, you are using thesearchcommand to filter results based on themsgfield. If the base search is already providing the relevant data, you may not need thesearchcommand again. Instead, you can directly use thetimechartcommand with the base search results. -
Timechart Command: Update the chart panel's
<search>element to directly use thetimechartcommand with the base search results. Here's how you can modify it:
<div><div> </div></div>
<chart>
<title>Customer response timeline</title>
<search base="base_search_app">
<query>| timechart count</query>
</search>
<option name="charting.chart">line</option>
<option name="charting.drilldown">none</option>
<option name="height">558</option>
<option name="refresh.display">progressbar</option>
</chart>
By removing the search command and using only timechart count, you will use the results from the base search and perform the timechart operation directly on that data.
-
Check for Errors: Check the Splunk logs for any errors related to the dashboard, the base search, or the chart panel. Sometimes, errors in the query or data may prevent the chart panel from displaying results.
-
Dashboard Context: Ensure that the dashboard context is set correctly to apply the time range picker (
$time.earliest$and$time.latest$) to the base search and the chart panel.
By following these steps and checking the query, data availability, and potential errors, you should be able to troubleshoot and make sure that the chart panel uses the base search correctly.