Start by checking the node, executed query, date range and metric definition. These usually explain differences more quickly than changing the visual style.
No data, zero and errors are different
| Symptom | What to check |
|---|---|
| Run a query to display widget data | In Investigations, execute Search after selecting the query and dates. |
| No data | Confirm events exist in the range, then check filters, event types, required attributes and thresholds. |
| Zero count | Confirm the count's unit and attribute. A missing account field can yield zero distinct accounts despite many events. |
| A large “–” group | Inspect missing or empty grouping values. Do not treat the group as one real device/account. |
| No models selected | Open the model settings and select a journey, step and model for the current node. |
| No data for this model yet | Check that the selected model emitted scores in the chosen period. |
| Blank map | Check coordinates and map rendering. Use a country/network table as a separate analysis. |
| Error / rendering error | Record the widget, node, dates and settings. An error does not mean there were no matching events. |
| Blank custom signal column | Check variable names, attribute availability and template references. |
| RENDER_MATH_ERROR | Guard against division by zero in a custom-column template. |
| Statistic shows Error | Check the selected attribute, its type and the math operation. |
Counts disagree
Check these definitions before comparing:
- Event count versus distinct account/device count.
- Signal matches versus events: one event can match several signals.
- Whole-period distinct count versus the sum of per-bucket distinct counts: the same entity can appear in several buckets.
- A top-results limit versus a complete population.
- Query-wide server calculations versus a chart based on loaded grid rows.
- An event condition versus a threshold on a calculated result.
- Current versus previous period, and completed versus incomplete periods.
- Missing identifiers, shared IP addresses, changed cookies and differing identity contexts.
An investigation link returns too many events
Inspect the generated query. A linked grouping value can identify a device or IP without preserving every original widget condition. Add the original step, event-type or outcome restriction where necessary, and confirm the date range before running Search.
A chart is difficult to read
Expand the card, use a larger panel layout, reduce the result limit or remove unnecessary grouping attributes. Set the legend to Fullscreen or Always when you need series names. For dense journey networks, narrow the period or focus the investigation on a smaller population.
Do not hide a missing-value group simply to make a chart look cleaner without understanding why the values are absent.
Settings are missing or read-only
Check the space's sharing scope and your permissions. All Cards is a read-only library. Create a User space initialised from that library to experiment. Editing organisation spaces requires template-administration permission. The available journeys, models and populated attributes also depend on the selected node.
Changes appeared without pressing Save
Board structure and layout save as you edit. Model selections apply when their popover closes. Shared widget settings use explicit preview/save controls, and investigation configurations require saving the intended template for reuse. Review the save-behaviour table in the spaces-and-boards article.
Export does not match the visible signal table
Signal Trigger Rate exports re-query all rows for the period and configured columns. They do not apply the table's signal search, column filters, sort order or pagination. Apply the required subset to the exported data before using it in a report.
Before sharing an analytical conclusion
Include the metric definition, node, dates, timezone, filters and known data gaps. Describe anomalies as findings to investigate unless the underlying event evidence supports a stronger conclusion. A dashboard threshold is a display setting; it does not demonstrate that the platform blocked or challenged traffic.