Splunk Search
Highlighted

unable to see data in visualization tab

Communicator

I am trying to create a time series chart but not getting any data in visualization tab.

index="test_data" sourcetype="SAP:data"  | lookup PROC_DETAIL PROC_CODE OUTPUT PROC_CODE PROC_NAME PROC_PARA PROC_TYPE   | search SYS_NAME="*" PROC_TYPE=* PROC_PARA=*  PROC_CODE=10130 | timechart span=5m max(PROC_VALUE) as "Max Value"

I am getting data in statistics tab like below. But in visualization tab not showing any chart.

_time               Max Value
2019-07-06 05:15:00 2
2019-07-06 05:20:00 2
2019-07-06 05:25:00 2
0 Karma
Highlighted

Re: unable to see data in visualization tab

Splunk Employee
Splunk Employee

What visualization is selected?

0 Karma
Highlighted

Re: unable to see data in visualization tab

Communicator

@kmorris_splunk , I have selected Line chart.

0 Karma
Highlighted

Re: unable to see data in visualization tab

Esteemed Legend

Try setting span=5m to something smaller and/or expanding the Timeplicker value. Also, make sure that you pick an appropriate visualization type. Most people are looking for Line Chart.

0 Karma
Highlighted

Re: unable to see data in visualization tab

Communicator

Hi @woodcock ,
I have used time range as Last 60 min and also tried with Last 15 min by selecting chart type as Line chart. But still not getting data in visualization tab.

0 Karma
Highlighted

Re: unable to see data in visualization tab

Esteemed Legend

Open a support case.

0 Karma
Highlighted

Re: unable to see data in visualization tab

Communicator

Hi @woodcock
Could you share the steps to create case.

0 Karma
Highlighted

Re: unable to see data in visualization tab

SplunkTrust
SplunkTrust
0 Karma
Highlighted

Re: unable to see data in visualization tab

Communicator

Hi @jkat54
I am using a free version of Splunk Enterprise for POC. Do they provide the support for free version?

0 Karma
Highlighted

Re: unable to see data in visualization tab

SplunkTrust
SplunkTrust

Did you try a different browser? Chrome and Firefox are the most friendly with Splunk vizualizations.

0 Karma