New to splunk - was running examples on the sample data provided with splunk Fundamentals 1
Documentation - Splunk® Enterprise Search Manual 6.4.8 - Page 110 - Example 1
Search command - sourcetype=access_* | chart sum(kb) over clientip by host - Formatted as stacked bar chart
When I execute this command on the sample data - I do see 131K events. However no visualization shows up. Am I missing anything?
I did try to format as bar chart - but still nothing shows up on visualization tab.
it is because kb
is not a field in the access_combined
sourcetype, which I'll assume is where the sample data is going to come from. Do you have kb
,clientip
,host
in your data? I'm going to assume it's bytes
you need to change the sum
command to.
http://docs.splunk.com/Documentation/Splunk/6.4.8/Search/Createnontimebasedcharts
you can submit doc feedback at the bottom of the page with your email address and mark if it was helpful or not and add any comments on questions/concerns/improvements to the doc. the doc team is extremely responsive and helpful.
that was it..issue resolved
it is because kb
is not a field in the access_combined
sourcetype, which I'll assume is where the sample data is going to come from. Do you have kb
,clientip
,host
in your data? I'm going to assume it's bytes
you need to change the sum
command to.
http://docs.splunk.com/Documentation/Splunk/6.4.8/Search/Createnontimebasedcharts
you can submit doc feedback at the bottom of the page with your email address and mark if it was helpful or not and add any comments on questions/concerns/improvements to the doc. the doc team is extremely responsive and helpful.
And the docs have been fixed. Changed "kb" to "bytes".