Visualization From Windows Universal Forwarder- What is this message?

[pmacdonald]

I am getting the following message when I switch to the Visualization tab after a search:

"Your search isn't generating any statistic or visualization results. Here are some possible ways to get results."

This is coming from a universal forwarder installed on a Windows server. I was trying to graph the network interface stats. I know I am missing something to allow me to do this.

[richgalloway]

That message is saying your data is not in a format suitable for graphing.  To create a graph you must have numeric data in a relationship to one or more other fields (usually also numeric) in the same event.  For example, you may want to see the number of bytes transferred during the day.

index=foo host=bar source="Perfmon:Network Interface"
| timechart span=1h sum(Value) as Bytes by counter