Kibana Visualaztion Data Table 'Missing' values

Elastic Stack Kibana
1

Hi, I'm trying to create a table that shows the breakdown of user with the number of login attempts from a workstation. When I initially ran this, I was seeing a number lower than expected. I checked the Show Missing field and I could see the missing counts but the source workstation now says Missing for each user login. One odd thing is the Missing field is always the highest number for each login attempt. Running a query in Discover shows the correct results.

Any ideas why it's showing this way?

Kibana%20Missing
Kibana Missing.png1690×816 42.9 KB

2

I'd need to see how you're building the aggregation (the stuff in the "Data" tab) to help you out. If you can't share a screenshot, can you at least explain the fields you're dealing with and how you're aggregating them?

3

Here is the screenshots.

Kibana%20Missing%202
Kibana Missing 2.png342×789 19.7 KB

Kibana%20Missing%203
Kibana Missing 3.png346×786 19.2 KB

4

Ok, so you're just splitting on username, and then splitting again on workstation. I'd guess that in your data, you've got records that capture a user's login attempt without a workstation name, which is why you see more attempts with a "Missing" value. Perhaps you have an issue with the way you're collection that information. Can you verify that you do/don't have records with a username but no workstation?

5

Yep, that was it. After looking at the data more closely, there are many fields that just have a dash instead of the workstation name so it's reading those as Missing.

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.