Hello,
I'm trying to move new apps on Splunk 4.3 to JSChart however I have problems with the following error when using PostProcess search: Search did not generate any statistical results.
If I click few times on link switcher the search will appear.
Anyone found any solution?
<module name="StaticContentSample" layoutPanel="viewHeader">
<param name="text"></p><ul><li><strong><a href="https://ocx/en-US/app/noss/fw_conn_formsearch">Firewall Connections Detail Form Search</param>
</module>
<module name="Search" layoutPanel="panel_row1_col1_grp2" autoRun="True">
<param name="search">eventtype="firewall_conn_count" | dedup error_code | rangemap field=active_conn low=0-1000 elevated=1001-2000 default=severe</param>
<param name="earliest">-1h</param>
<module name="SingleValue">
<param name="field">active_conn</param>
<param name="classField">range</param>
<param name="beforeLabel">Active Connections:</param>
</module>
</module>
<module name="Search" layoutPanel="panel_row1_col1_grp3" autoRun="True">
<param name="search">eventtype="firewall_conn_count" | dedup error_code | rangemap field=max_conn low=0-5000 elevated=5001-9000 default=severe</param>
<param name="earliest">-1h</param>
<module name="SingleValue">
<param name="field">max_conn</param>
<param name="classField">range</param>
<param name="beforeLabel">Max Connections:</param>
</module>
</module>
<module name="TimeRangePicker" layoutPanel="panel_row1_col1_grp1"><!-- Start TimeRangePicker -->
<param name="searchWhenChanged">True</param>
<param name="default">Today</param>
<module name="Search" layoutPanel="panel_row2_col1" autoRun="True"><!-- Start Connection Timeline Search -->
<param name="search">index="firewall_summary" stype="firewall_conn" | timechart span=1m sum(Built) as Built sum(Teardown) as Teardown</param>
<module name="JobProgressIndicator"/>
<module name="HiddenChartFormatter">
<param name="charting.legend.placement">bottom</param>
<param name="charting.primaryAxisTitle.text">Event Count</param>
<param name="charting.secondaryAxisTitle.text">Time</param>
<param name="charting.chart">line</param>
<param name="charting.fieldColors">{"Teardown":0xE51B1A,"Built":0x6C943B}</param>
<module name="JSChart">
<module name="Gimp"/>
<param name="width">100%</param>
<param name="height">250px</param>
</module>
</module>
</module><!-- End Connection Timeline Search -->
<module name="Search" layoutPanel="panel_row3_col1" autoRun="True"><!-- Start Connection Charts Search -->
<param name="search">eventtype="firewall_build_conn" conn_src_int="*" conn_src_host_local="*" conn_src_port_local="*" conn_src_host_global="*" conn_src_port_global="*" conn_dest_int="*" conn_dest_host_local="*" conn_dest_port_local="*" conn_dest_host_global="*" conn_dest_port_global="*" conn_id="*" conn_protocol="*" conn_type="*"</param>
<module name="LinkSwitcher" group="IP Address Details" layoutPanel="panel_row3_col1"><!-- Start IP Address Details Link Switcher -->
<param name="mode">independent</param>
<param name="label">Use the links bellow to switch between charts</param>
<module name="PostProcess" group="by Local Source IP" autoRun="True">
<param name="search">| stats count by conn_src_host_local | head 20</param>
<module name="HiddenChartFormatter">
<param name="charting.legend.placement">none</param>
<param name="charting.chart">pie</param>
<module name="JSChart">
<module name="Gimp"/>
<param name="width">100%</param>
<param name="height">250px</param>
</module>
</module>
</module>
<module name="PostProcess" group="by Local Destination IP" autoRun="False">
<param name="search">| stats count by conn_dest_host_local | head 20</param>
<module name="HiddenChartFormatter">
<param name="charting.legend.placement">none</param>
<param name="charting.chart">pie</param>
<module name="JSChart">
<module name="Gimp"/>
<param name="width">100%</param>
<param name="height">250px</param>
</module>
</module>
</module>
<module name="PostProcess" group="by Global Source IP" autoRun="False">
<param name="search">| stats count by conn_src_host_global | head 20</param>
<module name="HiddenChartFormatter">
<param name="charting.legend.placement">none</param>
<param name="charting.chart">pie</param>
<module name="JSChart">
<module name="Gimp"/>
<param name="width">100%</param>
<param name="height">250px</param>
</module>
</module>
</module>
<module name="PostProcess" group="by Global Destination IP" autoRun="False">
<param name="search">| stats count by conn_dest_host_global | head 20</param>
<module name="HiddenChartFormatter">
<param name="charting.legend.placement">none</param>
<param name="charting.chart">pie</param>
<module name="JSChart">
<module name="Gimp"/>
<param name="width">100%</param>
<param name="height">250px</param>
</module>
</module>
</module>
</module><!-- End IP Address Details Link Switcher -->
It looks like this might be due to a bug in the JSChart module when a post-process is being performed on a non-reporting search. Take a look at this post for a couple of work-around options.
This configuration should now work with the JSChart module in 4.3.1