topic Re: Why is a bar chart not showing up with my search? in Splunk Search

Why is a bar chart not showing up with my search?

zd00191 — Fri, 10 Jul 2015 22:07:57 GMT

tag="*" LocID="-7" SbuID="-7"  | dedup tag |rename ResponseDisplay AS "Application Response", AvailabilityDisplay AS "Application Availability" |chart values("Application Availability") values("Application Response") by tag

I am running the search above trying to get a bar chart with two data series, but the chart will not show up? please help! Thanks!

Re: Why is a bar chart not showing up with my search?

woodcock — Fri, 10 Jul 2015 22:17:04 GMT

You cannot chart values because it creates a mutli-value field and because it usually creates a non-numeric field. If you switch your values functions for count you will see your chart; if you switch it to max or last and your fields are numeric it will also plot. I do not know what you are trying to show but this is what is preventing the visualization.

Re: Why is a bar chart not showing up with my search?

zd00191 — Fri, 10 Jul 2015 22:20:39 GMT

tag="*" LocID="-7" SbuID="-7" | dedup tag |rename ResponseDisplay AS "Application Response", AvailabilityDisplay AS "Application Availability" |stats last("Application Availability") last("Application Response") by tag

it still does not work

Re: Why is a bar chart not showing up with my search?

woodcock — Fri, 10 Jul 2015 22:23:54 GMT

It should if you click on the "Visualization" tab. If you switch stats for chart then it will automatically switch to the Visualization tab.

Re: Why is a bar chart not showing up with my search?

zd00191 — Fri, 10 Jul 2015 22:29:54 GMT

100% is the value in both availability and reponse...I think it needs ot just be 100 so it is a number

Re: Why is a bar chart not showing up with my search?

woodcock — Sat, 11 Jul 2015 04:56:30 GMT

Try this:

tag="*" LocID="-7" SbuID="-7"  | dedup tag | rex field=ResponseDisplay "(?<Application_Response>\d+)" | rex field=AvailabilityDisplay "(?<Application_Availability>\d+)" | chart values(Application_Availability) values(Application_Response) by tag

I accidentally deleted some of our conversation and I am sorry about that. You said that the above is giving a rex error but I don't see how that is possible unless you changed it Be aware that the stuff inside angle brackets (``) is LITERAL and should not be modified in any way. Just take the search above and paste it as-is and it should work fine.