No Visualisation although enough values

ToniSchulz — Thu, 26 Mar 2015 18:29:47 GMT

Hello everyone,

I have a strange problem. I want to visualize two different temperatures over the time and wrote the following search query:

index=1_Scheibenkleben sourcetype=1_Scheibenkleben_csv Raumtemperatur=* OR Scheibentemperatur=*|chart list(Raumtemperatur) as RT, list(Scheibentemperatur) as ST over _time span=1d

The table that I get looks like this:

_time                       RT                                   ST
2015-01-01                  17,6
                            16,5
                            16,6
2015-01-02                  16,8                                22,6
                            16,9                                20,6
                                                                21
                            17                                  18
2015-01-03        etc.....

For this combination I don´t get a visualisation to work. The values in the chart are 0 although they are listed further down. When I directly use the chart command the same happens. It seems that the problem is, that for some time stamps the value for e.g. Scheibentemperatur ist 0 although the =* command. We used that command because some entrys don´t have values and this made us sure to not have too many of them. I also tried different spans and different time ranges, but no results.

Does anyone have an idea why that is?

Thanks a lot in advance!

Re: No Visualisation although enough values

stephanefotso — Thu, 26 Mar 2015 19:49:00 GMT

I think your query need parenthesis. try this:

index=1_Scheibenkleben sourcetype=1_Scheibenkleben_csv  (Raumtemperatur=* OR Scheibentemperatur=*)|chart list(Raumtemperatur) as RT, list(Scheibentemperatur) as ST over _time span=1d

Re: No Visualisation although enough values

ToniSchulz — Fri, 27 Mar 2015 06:58:39 GMT

Hi stephanefotso,

thanks for your answer! I tried that out, unfortunatly it did not change anything.
Could there be other reasons?

topic Re: No Visualisation although enough values in Splunk Search

No Visualisation although enough values

Re: No Visualisation although enough values

Re: No Visualisation although enough values