Rest API not populating Stacked Chart

[ThomasPowers (Tom Powers)]

Hello All,

So…we use the REST API extensively, and I’m hung up on the stacked_chart creation.

Here’s the JSON string we are sending at the REST API to make a 3 tiered bar graph

{
“cache_time”: 10,
“description”: “Write/Change/Add Timeline”,
“type”: “STACKED_CHART”,
“config”: {
“interval”: “hour”,
“timerange”: {
“type”: “relative”,
“range”: 86400
},
“renderer”: “bar”,
“interpolation”: “linear”,
“series”: [
{
“query”: “(EventID:4663 AND AccessMask:0x10000) OR (EventID:4659 AND (AccessMask:0x10080 OR AccessMask:0x0)) OR (EventID:4663 AND (AccessMask:0x10000 OR AccessMask:0x2)) AND NOT SubjectUserName:/.*/", "field": "AccessMask", "statistical_function": "count" }, { "query": "(EventID:4663 AND AccessMask:0x10000) OR (EventID:4659 AND (AccessMask:0x10080 OR AccessMask:0x0)) AND NOT SubjectUserName:/.*/”,
“field”: “AccessMask”,
“statistical_function”: “count”
},
{
“query”: “EventID:4663 AND AccessMask:0x4”,
“field”: “AccessMask”,
“statistical_function”: “count”
}
]
}
}

The issue is that the widget comes up with an N/A and when I look into it’s details, it looks like this:

What am I missing here?

All insight is appreciated

TP

[ThomasPowers (Tom Powers)]

Solution:

OK…so I found the issue for anyone who is browsing this.

I’m using powershell to send the JSON commands via Powershell

so when I was testing this, I had to convertto-json and add a -Depth command to get it to convert, otherwise the bracketed array for the Series is malformed.

This works in the Powershell conversion… just FYI

params = [PSCustomObject]@{ "cache_time"= 10; "description"= "Write/Change/Add Timeline"; "type"= "STACKED_CHART"; "config"= [PSCustomObject]@{ "interval"= "hour"; "timerange"= [PSCustomObject]@{ "type"= "relative"; "range"= 86400 }; "renderer"= "bar"; "interpolation"= "linear"; "series"= @( [PSCustomObject]@{ "query"= "(EventID:4663 AND AccessMask:0x10000) OR (EventID:4659 AND (AccessMask:0x10080 OR AccessMask:0x0)) OR (EventID:4663 AND (AccessMask:0x10000 OR AccessMask:0x2)) AND NOT SubjectUserName:/.*/";
“field”= “AccessMask”;
“statistical_function”= “count”
};
[PSCustomObject]@{
“query”= “(EventID:4663 AND AccessMask:0x10000) OR (EventID:4659 AND (AccessMask:0x10080 OR AccessMask:0x0)) AND NOT SubjectUserName:/.*$/”;
“field”= “AccessMask”;
“statistical_function”= “count”
};
[PSCustomObject]@{
“query”= “EventID:4663 AND AccessMask:0x4”;
“field”= “AccessMask”;
“statistical_function”= “count”
}
)
}
}

$body = (ConvertTo-Json $params -Depth 3)