https://community.splunk.com/t5/Alerting/Creating-per-server-report/m-p/59364#M809 <P>Here's one idea:</P> <PRE><CODE>... | timechart span=1h sum(numErrors) as ErrorCount by serverName </CODE></PRE> <P>This will show one line for each server. Each point on the line will represent one hour of errors.</P> <P>If you want more suggestions, we need a little more information, like - how did you get the three fields? What does the source look like?</P> <P>HTH!</P> Tue, 11 Dec 2012 15:18:11 GMT lguinn2 2012-12-11T15:18:11Z https://community.splunk.com/t5/Alerting/Creating-per-server-report/m-p/59363#M808 <P>Hello all</P> <P>I'm trying to create a report in Splunk (4.3.4). I can get the fields i want into a table but can't format a graph in the way i would like, this is what i'd really appreciate help with.</P> <P>So i am ending up with 3 fields:<BR /> datetime (e.g. "2012-12-11 09:01:02")<BR /> serverName (e.g. "clientRef-host1")<BR /> numErrors (e.g. 1234)</P> <P>What i would like is to have a line chart (although another type is fine if it displays the information logically) which shows:<BR /> x axis: datetime<BR /> y axis: numErrors<BR /> Lines: one line per serverName</P> <P>If anyone can offer advice on how to achieve this, i'd be very grateful - i though it would be simple but it's eluded me thus far!</P> <P>Many thanks<BR /> Neil</P> Tue, 11 Dec 2012 08:55:09 GMT https://community.splunk.com/t5/Alerting/Creating-per-server-report/m-p/59363#M808 neil_craig 2012-12-11T08:55:09Z https://community.splunk.com/t5/Alerting/Creating-per-server-report/m-p/59364#M809 <P>Here's one idea:</P> <PRE><CODE>... | timechart span=1h sum(numErrors) as ErrorCount by serverName </CODE></PRE> <P>This will show one line for each server. Each point on the line will represent one hour of errors.</P> <P>If you want more suggestions, we need a little more information, like - how did you get the three fields? What does the source look like?</P> <P>HTH!</P> Tue, 11 Dec 2012 15:18:11 GMT https://community.splunk.com/t5/Alerting/Creating-per-server-report/m-p/59364#M809 lguinn2 2012-12-11T15:18:11Z