topic Re: Visualization not working after extracting values from raw data in Dashboards & Visualizations

Visualization not working after extracting values from raw data

srizan — Mon, 15 Jun 2020 19:56:29 GMT

Raw Value:

logtype=audit 2020-06-15T12:25:52,650| tid:SDFGH3456gtbhjcfdt$%| AUTHN_REQUEST| | 38 | | 123| | asdxc| AS| ss| | | 40

Query:

index = "PF.log" | eval fields=split(_raw,"|") | eval response=mvindex(fields,13) | timechart values(response) BY host

I am interested in the last value which is 40 in this example. I tried converting the value tonumber and tried other conversion techniques which doesn't seem to work for some reason.

Re: Visualization not working after extracting values from raw data

srizan — Mon, 15 Jun 2020 20:07:04 GMT

I was able to work around using rex to extract the value. Still unsure why conversion did not work.

Re: Visualization not working after extracting values from raw data

richgalloway — Mon, 15 Jun 2020 20:09:29 GMT

If you switch to the Statistics tab do you see data? Are the _time, response, and host fields present?

Re: Visualization not working after extracting values from raw data

niketn — Tue, 16 Jun 2020 15:51:35 GMT

@srizan you would need to add trim if you are plotting it on chart as regular split with your data will have space around response value.

| eval response=trim(mvindex(fields,13))

Re: Visualization not working after extracting values from raw data

srizan — Tue, 16 Jun 2020 16:03:00 GMT

@niketn Thank you! That worked!! I was using rex to extract the value but this seems to be cleaner approach.