Splunk Search

Why is a bar chart not showing up with my search?

zd00191
Communicator
tag="*" LocID="-7" SbuID="-7"  | dedup tag |rename ResponseDisplay AS "Application Response", AvailabilityDisplay AS "Application Availability" |chart values("Application Availability") values("Application Response") by tag

I am running the search above trying to get a bar chart with two data series, but the chart will not show up? please help! Thanks!

Tags (3)
0 Karma
1 Solution

woodcock
Esteemed Legend

You cannot chart values because it creates a mutli-value field and because it usually creates a non-numeric field. If you switch your values functions for count you will see your chart; if you switch it to max or last and your fields are numeric it will also plot. I do not know what you are trying to show but this is what is preventing the visualization.

View solution in original post

0 Karma

woodcock
Esteemed Legend

You cannot chart values because it creates a mutli-value field and because it usually creates a non-numeric field. If you switch your values functions for count you will see your chart; if you switch it to max or last and your fields are numeric it will also plot. I do not know what you are trying to show but this is what is preventing the visualization.

View solution in original post

0 Karma

zd00191
Communicator

tag="*" LocID="-7" SbuID="-7" | dedup tag |rename ResponseDisplay AS "Application Response", AvailabilityDisplay AS "Application Availability" |stats last("Application Availability") last("Application Response") by tag

it still does not work

0 Karma

woodcock
Esteemed Legend

It should if you click on the "Visualization" tab. If you switch stats for chart then it will automatically switch to the Visualization tab.

0 Karma

zd00191
Communicator

100% is the value in both availability and reponse...I think it needs ot just be 100 so it is a number

0 Karma

woodcock
Esteemed Legend

Try this:

tag="*" LocID="-7" SbuID="-7"  | dedup tag | rex field=ResponseDisplay "(?<Application_Response>\d+)" | rex field=AvailabilityDisplay "(?<Application_Availability>\d+)" | chart values(Application_Availability) values(Application_Response) by tag

I accidentally deleted some of our conversation and I am sorry about that. You said that the above is giving a rex error but I don't see how that is possible unless you changed it Be aware that the stuff inside angle brackets (``) is LITERAL and should not be modified in any way. Just take the search above and paste it as-is and it should work fine.

Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!