I am getting the following message when I switch to the Visualization tab after a search:
"Your search isn't generating any statistic or visualization results. Here are some possible ways to get results."
This is coming from a universal forwarder installed on a Windows server. I was trying to graph the network interface stats. I know I am missing something to allow me to do this.
That message is saying your data is not in a format suitable for graphing. To create a graph you must have numeric data in a relationship to one or more other fields (usually also numeric) in the same event. For example, you may want to see the number of bytes transferred during the day.
index=foo host=bar source="Perfmon:Network Interface"
| timechart span=1h sum(Value) as Bytes by counter