https://community.splunk.com/t5/Splunk-Search/Can-t-get-chart-to-show-data/m-p/86424#M22040 <P>lguinn - That was it: it needs to be Value instead of value. Thank you.</P> Fri, 29 Jun 2012 14:29:22 GMT keithstone 2012-06-29T14:29:22Z https://community.splunk.com/t5/Splunk-Search/Can-t-get-chart-to-show-data/m-p/86422#M22038 <P>I have about 10 Windows computers using the universal forwarder to report CPU utilization, memory, disk and network consumption to a Splunk server. I'm trying to chart the average processor time per processor over the last 24 hours. The search clearly finds records that qualify for the search set, but the chart shows no data, whether in tabular form or bar chart.</P> <P>I'm trying to use</P> <P>host=xyz511* object=Processor counter="% Processor Time" | chart avg(value) over host</P> <P>The chart shows me the proper list of hosts, but the avg(value) has no value, yet if I look at the records list, I can see the records being used in the search set, and I can clearly see that each record has a value field with the data I want to average out. </P> <P>So I must be misunderstanding something.</P> Thu, 28 Jun 2012 17:00:54 GMT https://community.splunk.com/t5/Splunk-Search/Can-t-get-chart-to-show-data/m-p/86422#M22038 keithstone 2012-06-28T17:00:54Z https://community.splunk.com/t5/Splunk-Search/Can-t-get-chart-to-show-data/m-p/86423#M22039 <P>Note that field <STRONG>names</STRONG> are case-sensitive. (Field <STRONG>values</STRONG> are not.)<BR /> Shouldn't it be Value instead of value?</P> <P>Please forgive me if this is off-the-mark, but I can't get to any Windows data at this moment to test...</P> <PRE><CODE>ost=xyz511* object=Processor counter="% Processor Time" | chart avg(Value) over host </CODE></PRE> Fri, 29 Jun 2012 07:04:58 GMT https://community.splunk.com/t5/Splunk-Search/Can-t-get-chart-to-show-data/m-p/86423#M22039 lguinn2 2012-06-29T07:04:58Z https://community.splunk.com/t5/Splunk-Search/Can-t-get-chart-to-show-data/m-p/86424#M22040 <P>lguinn - That was it: it needs to be Value instead of value. Thank you.</P> Fri, 29 Jun 2012 14:29:22 GMT https://community.splunk.com/t5/Splunk-Search/Can-t-get-chart-to-show-data/m-p/86424#M22040 keithstone 2012-06-29T14:29:22Z