Splunk Search

unable to see data in visualization tab

twh1
Communicator

I am trying to create a time series chart but not getting any data in visualization tab.

index="test_data" sourcetype="SAP:data"  | lookup PROC_DETAIL PROC_CODE OUTPUT PROC_CODE PROC_NAME PROC_PARA PROC_TYPE   | search SYS_NAME="*" PROC_TYPE=* PROC_PARA=*  PROC_CODE=10130 | timechart span=5m max(PROC_VALUE) as "Max Value"

I am getting data in statistics tab like below. But in visualization tab not showing any chart.

_time               Max Value
2019-07-06 05:15:00 2
2019-07-06 05:20:00 2
2019-07-06 05:25:00 2
0 Karma

jkat54
SplunkTrust
SplunkTrust

Did you try a different browser? Chrome and Firefox are the most friendly with Splunk vizualizations.

0 Karma

twh1
Communicator

Hi @jkat54
I have tried this on multiple browser.

0 Karma

woodcock
Esteemed Legend

Try setting span=5m to something smaller and/or expanding the Timeplicker value. Also, make sure that you pick an appropriate visualization type. Most people are looking for Line Chart.

0 Karma

twh1
Communicator

Hi @woodcock ,
I have used time range as Last 60 min and also tried with Last 15 min by selecting chart type as Line chart. But still not getting data in visualization tab.

0 Karma

woodcock
Esteemed Legend

Open a support case.

0 Karma

twh1
Communicator

Hi @woodcock
Could you share the steps to create case.

0 Karma

jkat54
SplunkTrust
SplunkTrust
0 Karma

twh1
Communicator

Hi @jkat54
I am using a free version of Splunk Enterprise for POC. Do they provide the support for free version?

0 Karma

kmorris_splunk
Splunk Employee
Splunk Employee

What visualization is selected?

0 Karma

twh1
Communicator

@kmorris_splunk , I have selected Line chart.

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>