I'm trying to make visualizations appear. A simple column or bar chart. My search works exactly as intended (a series of columns for numbers and percent across spans of one day). But I can't get any visualizations anymore. What did I do, and is there a way to get back visualizations while also keeping my table?
host=server* Identifier=name EventType=various* EventType!=not_those
| rex "(?<DeviceId>[0-9a-zA-Z]+)\s+event"
| bucket _time span=1d
| eventstats dc(DeviceId) AS all_visitors by _time
| search (EventType="type1" OR EventType="type2" OR EventType="type3")
| stats first(all_visitors) AS all_visitors dc(DeviceId) AS dc_event_type by EventType, _time
| eval one=if(EventType="type1", dc_event_type, " ")
| eval two=if(EventType="type2", dc_event_type, " ")
| eval three=if(EventType="type3", dc_event_type, " ")
| eval percentage=round(dc_event_type/all_visitors*100,2)
| eval one%=if(EventType="type1", percentage, " ")
| eval two%=if(EventType="type2", percentage, " ")
| eval three%=if(EventType="type3", percentage, " ")
| timechart span=1d values(all_visitors) AS "Everybody"
values(one) AS "one" values(two) AS "two" values(three) AS "three"
values(one%) AS "one %" values(two%) AS "two %" values(three%) AS "three %"
... View more