https://community.splunk.com/t5/Dashboards-Visualizations/charting-the-values-not-the-instances/m-p/92821#M5051 <P>...been surfing for this question, can't find it, although I'm sure it's been answered...</P> <P>I can't figure out how to do (what I think is) a simple chart of the values in a field, not the number of times it's seen. For example, I have a simple cron.hourly script that creates a text file with a timestamp and a value (the drive space used in a given volume). </P> <P>It returns the following:</P> <P>Fri Nov 19 15:01:01 2010 percentage_used=42</P> <P>This is parsed fine (i.e. timestamp, "percentage_used" field) but when charting it, I can't figure out how to simply chart the values over time.</P> <P>To make matters more challenging is: ultimately I want to create a single chart of several of by systems' drive space over time (split by host). Doesn't seem too difficult, but I'm feeling a little short-bus on this...</P> <P>Thanks in advance! Mike</P> Sat, 20 Nov 2010 05:17:11 GMT Michael 2010-11-20T05:17:11Z https://community.splunk.com/t5/Dashboards-Visualizations/charting-the-values-not-the-instances/m-p/92821#M5051 <P>...been surfing for this question, can't find it, although I'm sure it's been answered...</P> <P>I can't figure out how to do (what I think is) a simple chart of the values in a field, not the number of times it's seen. For example, I have a simple cron.hourly script that creates a text file with a timestamp and a value (the drive space used in a given volume). </P> <P>It returns the following:</P> <P>Fri Nov 19 15:01:01 2010 percentage_used=42</P> <P>This is parsed fine (i.e. timestamp, "percentage_used" field) but when charting it, I can't figure out how to simply chart the values over time.</P> <P>To make matters more challenging is: ultimately I want to create a single chart of several of by systems' drive space over time (split by host). Doesn't seem too difficult, but I'm feeling a little short-bus on this...</P> <P>Thanks in advance! Mike</P> Sat, 20 Nov 2010 05:17:11 GMT https://community.splunk.com/t5/Dashboards-Visualizations/charting-the-values-not-the-instances/m-p/92821#M5051 Michael 2010-11-20T05:17:11Z https://community.splunk.com/t5/Dashboards-Visualizations/charting-the-values-not-the-instances/m-p/92822#M5052 <P>If you want to just show the values you could do " | stats list(percentage_used)" or " | stats values(percentage_used)", depending on if you wanted percentage used to be deduped or not. Also, in the end something like " | timechart per_hour(percentage_used) by host" is what you'll be looking for.</P> Sat, 20 Nov 2010 06:30:42 GMT https://community.splunk.com/t5/Dashboards-Visualizations/charting-the-values-not-the-instances/m-p/92822#M5052 kevintelford 2010-11-20T06:30:42Z