topic Re: Why do I not see data in my search's visualization? in Dashboards & Visualizations

Why do I not see data in my search's visualization?

iiooiiooiioo — Thu, 09 Apr 2020 17:43:16 GMT

I have this search:

host=app-dev-001 rehire OR terminating OR new_hire OR "changes supervisor" | convert timeformat="%Y-%m-%d %H:%M:%S" ctime(_time) AS date | sort date | table date rehire term_user new_hire super_change

and I get results:

date    rehire  term_user   new_hire    super_change
4/9/20 17:31        okaalsnd        
4/9/20 17:31        nineanls        
4/9/20 17:31        mcahmcui        
4/9/20 17:31        ogrga       
4/9/20 17:31        arjsgasp        
4/9/20 17:31        cbldenia        
4/9/20 17:31        rekenid     
4/9/20 17:31        luchgoja        
4/9/20 17:31        uhsig       
4/9/20 17:31        huanecdc        
4/9/20 17:31    erni            
4/9/20 17:31            stlieez.    
4/9/20 17:31            tmaonlhe.   
4/9/20 17:31            joedbers.   
4/9/20 17:31            inbhdrre.   
4/9/20 17:31            grarcacm.   
4/9/20 17:31            2loj.   
4/9/20 17:31            vavmeass.   
4/9/20 17:31            wuelnjoo.   
4/9/20 17:31    mhabin          
4/9/20 17:31    cleadmra            
4/9/20 17:31    nenahna         
4/9/20 17:31    nbveteen            
4/9/20 17:31                (sonaliue) changes supervisor from enfkaoi/id=83802 to fakesuper/id=42
4/9/20 17:31                (adkcuohh) changes supervisor from mhanaesr/id=134685 to fakesuper/id=42
4/9/20 17:31                (kvganeng) changes supervisor from nbynae/id=88564 to fakesuper/id=42
4/9/20 17:31                (ccncecpo) changes supervisor from hkdywaav/id=68086 to fakesuper/id=42
4/9/20 17:31                (jefai) changes supervisor from gawzignh/id=1163 to fakesuper/id=42
4/9/20 17:31                (uralsa) changes supervisor from rjajaaay/id=527197 to fakesuper/id=42

But when I click on the visualization table I get an empty graph.

Re: Why do I not see data in my search's visualization?

mitag — Thu, 09 Apr 2020 18:01:10 GMT

My understanding is that visualizations plot numerical values. For something to show up in your visualization, define what you need to visualize, and extract - or generate - numerical values representing that.

Re: Why do I not see data in my search's visualization?

iiooiiooiioo — Thu, 09 Apr 2020 18:27:04 GMT

Doh you are exactly right. I will modify my search to generate numerical counts.

Re: Why do I not see data in my search's visualization?

mitag — Thu, 09 Apr 2020 18:29:10 GMT

Cool! (Please mark my answer "accepted" if it worked for you.)

Re: Why do I not see data in my search's visualization?

iiooiiooiioo — Thu, 09 Apr 2020 18:35:38 GMT

I am using this search now:

host=app-dev-001 rehire OR terminating OR new_hire OR "changes supervisor" | convert timeformat="%Y-%m-%d" ctime(_time) AS date | stats count(rehire) count(term_user) count(newhire) count(super_change) by date