IBM QRadar

Hello,

we're running a multi-tenanted environment (release is 750 UP7 IF06); we are a MSSP and we're providing each customer a dedicated tenant.

It's not clear how to provide each of them meaningful dashboard views: each has some usernames that have a user role\security profile bonded to their tenant, so they can view only their own logs

Every user gets the 5 default dashboards (System Monitoring, Application overview and so on) but all the charts are blank (users get the message "No results were returned for this item" or "there was no time series data" for time series charts); oddly if I click on the link "View in log activity" I can correctly see the logs related to the chart. I attach an imge to better show what I'm seeing on the dashboards.

I was wondering if I have done something wrong with user permissions but nevertheless I'm able to see that data through Log activity tab..has someone any idea of what should be done to see the data in the charts?

Hello Davide,

These dashboards shows data from the accumulated data. For each specific tenant you need to get the accumulation enabled by at least one user from that tenant.

For graphs showing "There was no Time Series data for the search performed" please perform below steps to capture time series graph.
https://www.ibm.com/docs/no/qsip/7.4?topic=qradar-configuring-time-series-chart

If still need further assistance involve IBM Support team.