Dashboards & Visualizations

Why do I not see data in my search's visualization?

iiooiiooiioo
Explorer

I have this search:

host=app-dev-001 rehire OR terminating OR new_hire OR "changes supervisor" | convert timeformat="%Y-%m-%d %H:%M:%S" ctime(_time) AS date | sort date | table date rehire term_user new_hire super_change

and I get results:

date    rehire  term_user   new_hire    super_change
4/9/20 17:31        okaalsnd        
4/9/20 17:31        nineanls        
4/9/20 17:31        mcahmcui        
4/9/20 17:31        ogrga       
4/9/20 17:31        arjsgasp        
4/9/20 17:31        cbldenia        
4/9/20 17:31        rekenid     
4/9/20 17:31        luchgoja        
4/9/20 17:31        uhsig       
4/9/20 17:31        huanecdc        
4/9/20 17:31    erni            
4/9/20 17:31            stlieez.    
4/9/20 17:31            tmaonlhe.   
4/9/20 17:31            joedbers.   
4/9/20 17:31            inbhdrre.   
4/9/20 17:31            grarcacm.   
4/9/20 17:31            2loj.   
4/9/20 17:31            vavmeass.   
4/9/20 17:31            wuelnjoo.   
4/9/20 17:31    mhabin          
4/9/20 17:31    cleadmra            
4/9/20 17:31    nenahna         
4/9/20 17:31    nbveteen            
4/9/20 17:31                (sonaliue) changes supervisor from enfkaoi/id=83802 to fakesuper/id=42
4/9/20 17:31                (adkcuohh) changes supervisor from mhanaesr/id=134685 to fakesuper/id=42
4/9/20 17:31                (kvganeng) changes supervisor from nbynae/id=88564 to fakesuper/id=42
4/9/20 17:31                (ccncecpo) changes supervisor from hkdywaav/id=68086 to fakesuper/id=42
4/9/20 17:31                (jefai) changes supervisor from gawzignh/id=1163 to fakesuper/id=42
4/9/20 17:31                (uralsa) changes supervisor from rjajaaay/id=527197 to fakesuper/id=42

But when I click on the visualization table I get an empty graph.

alt text

0 Karma
1 Solution

mitag
Contributor

My understanding is that visualizations plot numerical values. For something to show up in your visualization, define what you need to visualize, and extract - or generate - numerical values representing that.

View solution in original post

mitag
Contributor

My understanding is that visualizations plot numerical values. For something to show up in your visualization, define what you need to visualize, and extract - or generate - numerical values representing that.

iiooiiooiioo
Explorer

Doh you are exactly right. I will modify my search to generate numerical counts.

iiooiiooiioo
Explorer

I am using this search now:

host=app-dev-001 rehire OR terminating OR new_hire OR "changes supervisor" | convert timeformat="%Y-%m-%d" ctime(_time) AS date | stats count(rehire) count(term_user) count(newhire) count(super_change) by date

mitag
Contributor

Cool! (Please mark my answer "accepted" if it worked for you.)

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...