tag="*" LocID="-7" SbuID="-7" | dedup tag |rename ResponseDisplay AS "Application Response", AvailabilityDisplay AS "Application Availability" |chart values("Application Availability") values("Application Response") by tag
I am running the search above trying to get a bar chart with two data series, but the chart will not show up? please help! Thanks!
You cannot chart
values because it creates a
mutli-value field and because it usually creates a
non-numeric field. If you switch your
values functions for
count you will see your chart; if you switch it to
last and your fields are
numeric it will also plot. I do not know what you are trying to show but this is what is preventing the visualization.
tag="*" LocID="-7" SbuID="-7" | dedup tag |rename ResponseDisplay AS "Application Response", AvailabilityDisplay AS "Application Availability" |stats last("Application Availability") last("Application Response") by tag
it still does not work
It should if you click on the "Visualization" tab. If you switch
chart then it will automatically switch to the
tag="*" LocID="-7" SbuID="-7" | dedup tag | rex field=ResponseDisplay "(?<Application_Response>\d+)" | rex field=AvailabilityDisplay "(?<Application_Availability>\d+)" | chart values(Application_Availability) values(Application_Response) by tag
I accidentally deleted some of our conversation and I am sorry about that. You said that the above is giving a rex error but I don't see how that is possible unless you changed it Be aware that the stuff inside angle brackets (``) is LITERAL and should not be modified in any way. Just take the search above and paste it as-is and it should work fine.