topic Re: Visualization for data with large difference in values. in Splunk Dev

Visualization for data with large difference in values.

GenericSplunkUs — Mon, 24 Jul 2017 21:11:55 GMT

I can't seem to find the right terms to search to find my answer so I'm hoping someone here can help me.

I'm looking for a clean way to do the timechart command when your field values could be 5 or 500,000. With such a large difference it makes plotting them on a map useless for the smaller numbered results. I would do this to a table, but it's nice to have the timechart command show the usage over time and make it a good visual reference.

If you have another way to do this, or another command I should use that would be great.

Thanks,

Re: Visualization for data with large difference in values.

DalJeanis — Mon, 24 Jul 2017 22:52:31 GMT

Go ahead and use timechart. Change the visualization format for the Y axis to log.

Re: Visualization for data with large difference in values.

GenericSplunkUs — Tue, 25 Jul 2017 13:49:49 GMT

Thank you, this is exactly what I wanted. I knew it had to be a simple option i just couldn't find.

Re: Visualization for data with large difference in values.

DalJeanis — Tue, 25 Jul 2017 21:26:52 GMT

Yw. @GenericSplunkUser - if your question has been answered, then please accept the answer so the question will show as solved.

Re: Visualization for data with large difference in values.

GenericSplunkUs — Tue, 25 Jul 2017 21:29:03 GMT

I thought i had done that, Thanks for the reminder.