All of a sudden, on only some of the charts in this dashboard, I am seeing what's in the pics attached. The data is there, and the logs are there, but the slices are not rendering in the pie charts. Has anyone seen this before?
Thanks!
I found the issue, but I am not sure why it is the answer.
These dashboards are built on summary indexes. I was using "search_name"= for the report that generates the data. I switched it to "source=", and now everything works. I had forgotten that we had this issue before, and that was the fix.
Thanks!
I found the issue, but I am not sure why it is the answer.
These dashboards are built on summary indexes. I was using "search_name"= for the report that generates the data. I switched it to "source=", and now everything works. I had forgotten that we had this issue before, and that was the fix.
Thanks!
Your count
values are all zero; there is nothing to display! Click on one of the 0
values to open in search and figure out what is broken.
That is part of the problem. There are results. When you click on 0, there are results. There wouldn't be 4 entries listed if there were 0 results.
Yes, there would, depending on what you are counting! You have events and your events have the by
field but they may not have the things that you are counting so the count
of those things is 0
. For example, if you are using something like count(eval(SomeField="SomeValue"))
and your field extractions for SomeField
are broken (or if the work but none has the value SomeValue
) then your counts will be 0. This is exactly why you should always include the searches, configurations and sample event data.
But these are dashboards that are almost a year old. They've worked with no issue until this morning.