Dashboards & Visualizations

Visualization From Windows Universal Forwarder- What is this message?

pmacdonald
Explorer

I am getting the following message when I switch to the Visualization tab after a search:

"Your search isn't generating any statistic or visualization results. Here are some possible ways to get results."

This is coming from a universal forwarder installed on a Windows server. I was trying to graph the network interface stats. I know I am missing something to allow me to do this.

 

SPLUNKScreenshot.png

0 Karma

richgalloway
SplunkTrust
SplunkTrust

That message is saying your data is not in a format suitable for graphing.  To create a graph you must have numeric data in a relationship to one or more other fields (usually also numeric) in the same event.  For example, you may want to see the number of bytes transferred during the day.

index=foo host=bar source="Perfmon:Network Interface"
| timechart span=1h sum(Value) as Bytes by counter
---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...