Discover Results Do Not Match Visualization Results

[codewriterguy (Patrick Kinsella)]

Hi,

Querying in Discover gives some number of results:

The same query in a visualization isn't giving any results:

Do both of these use the index pattern, and shouldn't both get the same query results for the same time frame and the same index? Anything I can check that would cause disparity?

[nickpeihl]

Hi Patrick. There should be an "Inspect" button on the top of the page in both applications. You can use this to see the Elasticsearch queries and results. Perhaps you can find the cause of the disparity by comparing the query/result of both applications.

[codewriterguy (Patrick Kinsella)]

Thank you @nickpeihl! Didn't know about the Inspect button, this is helpful! Turns out there was not, in fact, a discrepancy and I just didn't understand what I was looking at.

I was looking at a Lens, when I thought what I had was an aggregation-based viz for a data table.

Interestingly, I didn't see the Inspect button on the Lens creator, but I did see it elsewhere and it's a useful tool.

[nickpeihl]

Hi Patrick. Looks like the Inspector was added to the Lens editor in 7.16. Perhaps you have an older version of Kibana? [Lens] Inspect flyout should be available in editor mode. by alexwizp · Pull Request #109656 · elastic/kibana · GitHub

[codewriterguy (Patrick Kinsella)]

Oh yes! We have 7.8.0

[stephenb (Stephen Brown)]

@codewriterguy

Looks to me you You have no rows (obvious) but I don't see rows configured

Can you show the entire configuration?

What if you just use Count?

7.8 is so old hard for me to recall what it looked like back then... a Row Setting is required in the table in newer versions.

And / Or Try a vertical Bar chart with Date Histogram for x axis and count for Y start from there...

Then perhaps go back to the table.

[codewriterguy (Patrick Kinsella)]

This is correct. Marking as solution. The count does show records coming back, and I didn't add any rows. Thank you for the help all