https://community.splunk.com/t5/Splunk-Search/Splunk-Visualization-Char-counting-by-wrong-field/m-p/463259#M130589 <P>I have a monitoring search, that we are viewing both as a graph and when drilling in, as the events. When viewing the events, the information is correct, no issue, but when viewing the data as a chart, every once in a while we get an error.</P> <P>Normally the graphs bars are counting by the Clinet_IP and the number of event it sees, but for some it randomly switches to counting by by the user name (while still saying it's the Client_IP).... For clarification, most user names are either 'unknown' or 'domain\123456' but some are just '123456' and it's those that are causing issues. </P> <P>I don't want to take out the usernames from the search, as it provides valuable information when the team is drilling into the events, but this error is annoying to deal with.</P> <P>This is the search we are running:</P> <P>index="pan_logs"<BR /><BR /> | search action=blocked NOT "symantec" <BR /> | fillnull user value="N/A"<BR /><BR /> | stats values(http_category) values(dest_name) values(user) as UserName count by client_ip | sort -count | head 100</P> Wed, 30 Sep 2020 04:03:46 GMT RyanDonnelly22 2020-09-30T04:03:46Z https://community.splunk.com/t5/Splunk-Search/Splunk-Visualization-Char-counting-by-wrong-field/m-p/463259#M130589 <P>I have a monitoring search, that we are viewing both as a graph and when drilling in, as the events. When viewing the events, the information is correct, no issue, but when viewing the data as a chart, every once in a while we get an error.</P> <P>Normally the graphs bars are counting by the Clinet_IP and the number of event it sees, but for some it randomly switches to counting by by the user name (while still saying it's the Client_IP).... For clarification, most user names are either 'unknown' or 'domain\123456' but some are just '123456' and it's those that are causing issues. </P> <P>I don't want to take out the usernames from the search, as it provides valuable information when the team is drilling into the events, but this error is annoying to deal with.</P> <P>This is the search we are running:</P> <P>index="pan_logs"<BR /><BR /> | search action=blocked NOT "symantec" <BR /> | fillnull user value="N/A"<BR /><BR /> | stats values(http_category) values(dest_name) values(user) as UserName count by client_ip | sort -count | head 100</P> Wed, 30 Sep 2020 04:03:46 GMT https://community.splunk.com/t5/Splunk-Search/Splunk-Visualization-Char-counting-by-wrong-field/m-p/463259#M130589 RyanDonnelly22 2020-09-30T04:03:46Z https://community.splunk.com/t5/Splunk-Search/Splunk-Visualization-Char-counting-by-wrong-field/m-p/463260#M130590 <P>How do you want to display <EM>UserName</EM> ?<BR /> 123456 -&gt; user123456 ?</P> Thu, 06 Feb 2020 23:52:40 GMT https://community.splunk.com/t5/Splunk-Search/Splunk-Visualization-Char-counting-by-wrong-field/m-p/463260#M130590 to4kawa 2020-02-06T23:52:40Z