I have this search:
host=app-dev-001 rehire OR terminating OR new_hire OR "changes supervisor" | convert timeformat="%Y-%m-%d %H:%M:%S" ctime(_time) AS date | sort date | table date rehire term_user new_hire super_change
and I get results:
date rehire term_user new_hire super_change
4/9/20 17:31 okaalsnd
4/9/20 17:31 nineanls
4/9/20 17:31 mcahmcui
4/9/20 17:31 ogrga
4/9/20 17:31 arjsgasp
4/9/20 17:31 cbldenia
4/9/20 17:31 rekenid
4/9/20 17:31 luchgoja
4/9/20 17:31 uhsig
4/9/20 17:31 huanecdc
4/9/20 17:31 erni
4/9/20 17:31 stlieez.
4/9/20 17:31 tmaonlhe.
4/9/20 17:31 joedbers.
4/9/20 17:31 inbhdrre.
4/9/20 17:31 grarcacm.
4/9/20 17:31 2loj.
4/9/20 17:31 vavmeass.
4/9/20 17:31 wuelnjoo.
4/9/20 17:31 mhabin
4/9/20 17:31 cleadmra
4/9/20 17:31 nenahna
4/9/20 17:31 nbveteen
4/9/20 17:31 (sonaliue) changes supervisor from enfkaoi/id=83802 to fakesuper/id=42
4/9/20 17:31 (adkcuohh) changes supervisor from mhanaesr/id=134685 to fakesuper/id=42
4/9/20 17:31 (kvganeng) changes supervisor from nbynae/id=88564 to fakesuper/id=42
4/9/20 17:31 (ccncecpo) changes supervisor from hkdywaav/id=68086 to fakesuper/id=42
4/9/20 17:31 (jefai) changes supervisor from gawzignh/id=1163 to fakesuper/id=42
4/9/20 17:31 (uralsa) changes supervisor from rjajaaay/id=527197 to fakesuper/id=42
But when I click on the visualization table I get an empty graph.
My understanding is that visualizations plot numerical values. For something to show up in your visualization, define what you need to visualize, and extract - or generate - numerical values representing that.
My understanding is that visualizations plot numerical values. For something to show up in your visualization, define what you need to visualize, and extract - or generate - numerical values representing that.
Doh you are exactly right. I will modify my search to generate numerical counts.
I am using this search now:
host=app-dev-001 rehire OR terminating OR new_hire OR "changes supervisor" | convert timeformat="%Y-%m-%d" ctime(_time) AS date | stats count(rehire) count(term_user) count(newhire) count(super_change) by date
Cool! (Please mark my answer "accepted" if it worked for you.)