Showing results for 
Search instead for 
Did you mean: 

SIEM - custom time series charts issue

SIEM - custom time series charts issue

New Contributor III
I have a problem with custom dashbords after upgrade system to latest version Build 20160816201941. I have few time series chats like full dhcp log, showing count of events, filter by 'event name' in time range like 3 or 7 days. And after upgrade every chat start to showing this info:

There was no Time Series data for the search performed.

I was trying to create new search, Capture Time Series Data is selected and saved as new, also update details aint helping.

I noticed that there is some function 'Data Accumulation Data is currently being accumulated for the search. Unique counts are disabled'. But enabling also aint helping. Trying to search something to change in admin -> aggregated data management, but also nothing happens.

Google told me that qradar got this issue, when user was login as normal user not admin. It was resolved in 7.2.6 patch 3
Relogin to admin and doing everything once again failed.

Any one got same issue?



New Contributor
Michał, Are you still getting the correct values in the Time-Series graph when changing the value parameter to 'Event Count'?

yup, works fine.

New Contributor III


Changing count to 'event count', helped..but are this the same values? Looks ok.