Splunk Search

unable to see data in visualization tab

twh1
Communicator

I am trying to create a time series chart but not getting any data in visualization tab.

index="test_data" sourcetype="SAP:data"  | lookup PROC_DETAIL PROC_CODE OUTPUT PROC_CODE PROC_NAME PROC_PARA PROC_TYPE   | search SYS_NAME="*" PROC_TYPE=* PROC_PARA=*  PROC_CODE=10130 | timechart span=5m max(PROC_VALUE) as "Max Value"

I am getting data in statistics tab like below. But in visualization tab not showing any chart.

_time               Max Value
2019-07-06 05:15:00 2
2019-07-06 05:20:00 2
2019-07-06 05:25:00 2
0 Karma

jkat54
SplunkTrust
SplunkTrust

Did you try a different browser? Chrome and Firefox are the most friendly with Splunk vizualizations.

0 Karma

twh1
Communicator

Hi @jkat54
I have tried this on multiple browser.

0 Karma

woodcock
Esteemed Legend

Try setting span=5m to something smaller and/or expanding the Timeplicker value. Also, make sure that you pick an appropriate visualization type. Most people are looking for Line Chart.

0 Karma

twh1
Communicator

Hi @woodcock ,
I have used time range as Last 60 min and also tried with Last 15 min by selecting chart type as Line chart. But still not getting data in visualization tab.

0 Karma

woodcock
Esteemed Legend

Open a support case.

0 Karma

twh1
Communicator

Hi @woodcock
Could you share the steps to create case.

0 Karma

jkat54
SplunkTrust
SplunkTrust
0 Karma

twh1
Communicator

Hi @jkat54
I am using a free version of Splunk Enterprise for POC. Do they provide the support for free version?

0 Karma

kmorris_splunk
Splunk Employee
Splunk Employee

What visualization is selected?

0 Karma

twh1
Communicator

@kmorris_splunk , I have selected Line chart.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...