IBM Support

QRadar: Time series graphs on dashboards do not display data when the dashboard is shared across security profiles

Troubleshooting


Problem

When a user creates a dashboard and shares it with the users who are in a different security profile, the time series graphs on that dashboard do not automatically populate with data.

Symptom

For example, consider that user User1 in Security_Profile1 shares the dashboard with user User2 in Security_Profile2. When the dashboard is first accessed by User2, the time series graphs are rendered without any data. The graph displays a message that states, "Time Series data unavailable at this time."
image 12869

Cause

Dashboard time series graphs are populated by using Global Views. Each security profile has its own instances of the Global Views that feed the graphs. When a dashboard is shared, the time series data in the Global Views is not captured automatically, and hence no data is displayed on the graphs.

Resolving The Problem

Time series data starts being captured when any one user from the target security profile, checks the "Capture Time Series Data" checkbox and clicks the Save button. Once this is done, the data is captured for that Global View, and is visible to all the users in the target security profile.
 
For example, if user User2 checks the "Capture Time Series Data" checkbox, the graph is populated for that user. Apart, if Security_Profile2 has another user called User3, the graph displays data for that user as well. There is no explicit need for User3 to check the checkbox again.
image 12886
Results
Once you check the "Capture Time Series Data" checkbox and click save, the graph will be populated. If you still face issues with the dashboard graph, contact IBM Support for a possible workaround.

Document Location

Worldwide

[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwtIAAQ","label":"Dashboard"}],"ARM Case Number":"","Platform":[{"code":"PF016","label":"Linux"}],"Version":"All Versions"}]

Document Information

Modified date:
25 January 2023

UID

ibm16846195