# Can I update a graph? **URL:** \ **Category:** Elasticsearch\ **Created:** [September 27, 2017, 1:58pm UTC](https://discuss.elastic.co/t/can-i-update-a-graph/101991 "2017-09-27T13:58:00Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [September 27, 2017, 1:58pm UTC](https://discuss.elastic.co/t/can-i-update-a-graph/101991/1 "2017-09-27T13:58:00Z")
I am trying to use the Graph feature and it does not work in the way I expect. I have IIS logs indexed, and I used the logstash useragent plugin to parse the UA strings. I start with a new graph (in a 5.6.1 stack), and add ua\_details.os\_name and ua\_details.name as sources for vertices. I set Max terms per hop to 2 on both and turn off Settings / significant links. When I do a query against \* I get a pair of 4 node graphs. So far so good. If I increase Max terms per hop to 12 for ua\_details.name and do another search against \* then now I get graphs where each OS is linked to several browsers, but no browser is linked to more than 2 OSes. This is also OK. Now I decrease Max terms per hop back to 2. When I do another search the graph does not change. It does not go back to the graph I got for the original graph with both set to 2. If I then try to add a search for, say, ua\_details.name: "Chrome" the graph still does not change. Should it? When I check the Settings / Last Request / Response after requesting ua\_details.name: "Chrome" it has only four nodes (Chrome, Window 7, Windows 10, IE) and 9 connections , but the graph rendered still has all 20 nodes from the second graph. I am expecting that a query ua\_details.name: "Chrome" would cause it only to sample documents that match that query, but the fact that it gets an IE node back tells me that doesn't work the way I expect. What does it do? ---
**Author:** ![Mark\_Harwood](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mark_harwood/32/10538_2.png) [@Mark\_Harwood](https://discuss.elastic.co/u/Mark_Harwood)\ **Post date:** [September 28, 2017, 5:14pm UTC](https://discuss.elastic.co/t/can-i-update-a-graph/101991/2 "2017-09-28T17:14:20Z")
The searches are additive - they expand upon what is already in the workspace. If you change your mind about how many terms-per-hop you want that is a setting used for the next query whose results are added to the existing nodes in the workspace. It does not revise any existing nodes already gathered. If you want to clear the workspace ready for a search with new settings, hit the delete button in the toolbar. Hope this makes sense. ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [September 28, 2017, 9:49pm UTC](https://discuss.elastic.co/t/can-i-update-a-graph/101991/3 "2017-09-28T21:49:56Z")
> [@Mark\_Harwood](#): > > If you want to clear the workspace ready for a search with new settings, hit the delete button in the toolbar. I think it would be better to hit New in most cases 😉 ---
**Author:** ![Mark\_Harwood](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mark_harwood/32/10538_2.png) [@Mark\_Harwood](https://discuss.elastic.co/u/Mark_Harwood)\ **Post date:** [September 28, 2017, 9:56pm UTC](https://discuss.elastic.co/t/can-i-update-a-graph/101991/4 "2017-09-28T21:56:54Z")
> [@Badger](#): > > I think it would be better to hit New in most cases Making a new workspace requires as a minimum a selection of an index pattern and fieldname and optionally any colours/icons and drill-down urls. ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [September 28, 2017, 11:14pm UTC](https://discuss.elastic.co/t/can-i-update-a-graph/101991/5 "2017-09-28T23:14:38Z")
Yes, but Delete deletes a saved graph and then gets you to the exact same place as New anyways. What am I missing here? ---
**Author:** ![Mark\_Harwood](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mark_harwood/32/10538_2.png) [@Mark\_Harwood](https://discuss.elastic.co/u/Mark_Harwood)\ **Post date:** [September 29, 2017, 7:09am UTC](https://discuss.elastic.co/t/can-i-update-a-graph/101991/6 "2017-09-29T07:09:25Z")
Ah. I thought we might be talking at cross purposes 🙂 ![Kibana](https://us1.discourse-cdn.com/elastic/original/3X/3/d/3d4e289447d09cbb7b56baf0bac27e776bebe9ad.png) ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [October 27, 2017, 7:09am UTC](https://discuss.elastic.co/t/can-i-update-a-graph/101991/7 "2017-10-27T07:09:36Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.