Can't see data in dashboard items

Depending on the type of chart, you can try several options to troubleshoot the problem.

Procedure

  1. To troubleshoot items that use AQL as the data source, try the following suggestions:
    1. Make sure that your AQL statements work properly.
    2. Dashboard items on the Event and flow metrics dashboard use parameters that must contain values to properly display data. Add values to the parameters or replace the placeholders for IP addresses for the console and managed host.
    3. The Ariel server might be temporarily unavailable or offline. Wait for it to come back online and run the AQL queries again.
    4. Go to the Log Activity or Network Activity tabs and run an AQL search to get the auto-completion and messaging. If you're satisfied with the results you see, copy and paste the statement into the Query section in IBM® QRadar® Pulse.
    5. Make sure you're using the current version of the templates. For information about how to download templates, see Upgrading QRadar Pulse.
    6. If your AQL query contains a string comparison similar to the following example, the Log Activity tab doesn't return any data, because QRadar Pulse sets the AQL string to lowercase, which breaks the comparison.
      select logsourceid, logsourcename(logsourceid), category, categoryname(category)
      from events
      where logsourcename(logsourceid) = '<a log source on you system>'
      last 15 minutes

      As a workaround, use the ILIKE operator instead of =. Another workaround is to edit the AQL query in the Log Activity or Network Activity tabs.

  2. To troubleshoot items that use offenses as the data source, go to the Offenses tab and make sure that IBM QRadar is receiving offenses from your network.