tag="*" LocID="-7" SbuID="-7" | dedup tag |rename ResponseDisplay AS "Application Response", AvailabilityDisplay AS "Application Availability" |chart values("Application Availability") values("Application Response") by tag
I am running the search above trying to get a bar chart with two data series, but the chart will not show up? please help! Thanks!
You cannot chart values
because it creates a mutli-value
field and because it usually creates a non-numeric
field. If you switch your values
functions for count
you will see your chart; if you switch it to max
or last
and your fields are numeric
it will also plot. I do not know what you are trying to show but this is what is preventing the visualization.
You cannot chart values
because it creates a mutli-value
field and because it usually creates a non-numeric
field. If you switch your values
functions for count
you will see your chart; if you switch it to max
or last
and your fields are numeric
it will also plot. I do not know what you are trying to show but this is what is preventing the visualization.
tag="*" LocID="-7" SbuID="-7" | dedup tag |rename ResponseDisplay AS "Application Response", AvailabilityDisplay AS "Application Availability" |stats last("Application Availability") last("Application Response") by tag
it still does not work
It should if you click on the "Visualization" tab. If you switch stats
for chart
then it will automatically switch to the Visualization
tab.
100% is the value in both availability and reponse...I think it needs ot just be 100 so it is a number
Try this:
tag="*" LocID="-7" SbuID="-7" | dedup tag | rex field=ResponseDisplay "(?<Application_Response>\d+)" | rex field=AvailabilityDisplay "(?<Application_Availability>\d+)" | chart values(Application_Availability) values(Application_Response) by tag
I accidentally deleted some of our conversation and I am sorry about that. You said that the above is giving a rex error but I don't see how that is possible unless you changed it Be aware that the stuff inside angle brackets (``) is LITERAL and should not be modified in any way. Just take the search above and paste it as-is and it should work fine.