# Help creating a visualization? **URL:** \ **Category:** Elasticsearch\ **Created:** [July 2, 2024, 3:50am UTC](https://discuss.elastic.co/t/help-creating-a-visualization/362331 "2024-07-02T03:50:35Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![amv](https://avatars.discourse-cdn.com/v4/letter/a/a9adbd/32.png) [@amv](https://discuss.elastic.co/u/amv)\ **Post date:** [July 2, 2024, 3:50am UTC](https://discuss.elastic.co/t/help-creating-a-visualization/362331/1 "2024-07-02T03:50:35Z")
Hey everyone, I've stood up Fleet and elastic which i finally got working properly. My question is with the discover / search. I'm trying to create a dashboard from this: `agent.name:* and winlog.event_id:4624 and winlog.event_data.TargetUserName:* and not winlog.event_data.targetusername:system and not source.ip:127.0.0.1` I'm used to splunk where if I needed to create a table, I could and I could table out some or all of the messages in say, winlog.event\_data.Message and it would go into a table row. I'm trying to do the same thing but once I add that to the table with lens, it fails and I can't see any of the data. How can I set this up so that the messages are returned? Thanks, anthony. ---
**Author:** ![carly.richmond](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/carly.richmond/32/104935_2.png) [@carly.richmond](https://discuss.elastic.co/u/carly.richmond)\ **Post date:** [July 2, 2024, 10:05am UTC](https://discuss.elastic.co/t/help-creating-a-visualization/362331/2 "2024-07-02T10:05:52Z")
Hi @amv, Welcome! Which version of Kibana are you using? Are you getting a particular error when creating the lens visualization? ---
**Author:** ![amv](https://avatars.discourse-cdn.com/v4/letter/a/a9adbd/32.png) [@amv](https://discuss.elastic.co/u/amv)\ **Post date:** [July 2, 2024, 3:07pm UTC](https://discuss.elastic.co/t/help-creating-a-visualization/362331/3 "2024-07-02T15:07:24Z")
Hey Carly, Thanks for replying. I am using... 8.14.1? ![image](https://us1.discourse-cdn.com/elastic/original/3X/5/8/580da9b0c016c4ee02e3ef87f600053c30df17a2.png) It's not so much an error it's returning blank. I know it's doing a count for the logins and I can share screenshots if you'd like but when i add the winlog.event\_data.Message as a table item it goes blank and says "no results found" I know with splunk if I wanted that data in the table I could do something like: index="winevent" sourcetype="security" eventid="XXX" usersam="xxx" | table \_time eventid usersam eventDesc (or something along those lines, haven't messed with splunk in a bit) and it would populate all that information plus the horrid description of the event. is there a way to do this in kibana? Thanks, Anthony ---
**Author:** ![carly.richmond](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/carly.richmond/32/104935_2.png) [@carly.richmond](https://discuss.elastic.co/u/carly.richmond)\ **Post date:** [July 3, 2024, 8:45am UTC](https://discuss.elastic.co/t/help-creating-a-visualization/362331/4 "2024-07-03T08:45:15Z")
Hi @amv, 8.14.1 looks right from your screenshot. Are you using the Discover screen or trying to create a Lens visualization? It sounds like there isn't a winlog event document that matches that precise query, so it might be worth checking the query, if you need parenthesis (as looking at your query I see 2 conditions for `targetusername`) and also the date range you have selected in the top right corner. Since you say you are familiar with Splunk the ES|QL query language may be easier for you than the default of KQL. You can use ES|QL in Discover. I would recommend having a look at the [getting started](https://www.elastic.co/guide/en/elasticsearch/reference/current/esql-getting-started.html) and the [command reference](https://www.elastic.co/guide/en/elasticsearch/reference/current/esql-language.html). Hope that helps!