https://community.splunk.com/t5/Dashboards-Visualizations/Plotting-on-yaxis/m-p/105891#M5972 <P>One of the tricks to charting is that Splunk requires one of the chart/timechart functions for the y-axis. In the example data above, you could use variety of different functions - I will use <CODE>max</CODE></P> <P>Second, you need to know the field names for your data. For this example, I will assume that Splunk has correctly identified the date/time of the event, and that you also have fields named <CODE>busy</CODE> and <CODE>processor</CODE></P> <PRE><CODE>yoursearchhere | eval busy = tonumber(replace(busy,"%","")) | timechart span=1h max(busy) by processor </CODE></PRE> Mon, 29 Oct 2012 20:32:00 GMT lguinn2 2012-10-29T20:32:00Z https://community.splunk.com/t5/Dashboards-Visualizations/Plotting-on-yaxis/m-p/105890#M5971 <P>Need to plot line chart below table "Max Busy Rate by processor" and want to show % values on yaxis and time on x-axis. </P> <P>1 Date/Time Max Busy Rate Processor <BR /> 2 10/29/2012 11:00 12% CHA-1H-3 <BR /> 3 10/29/2012 11:00 1% CHA-1H-2 <BR /> 4 10/29/2012 11:00 17% CHA-1H-1 <BR /> 5 10/29/2012 11:00 9% CHA-1H-0 <BR /> 6 10/29/2012 11:00 27% CHA-1H-3 <BR /> 7 10/29/2012 11:00 3% CHA-1H-2 <BR /> 8 10/29/2012 11:00 15% CHA-1H-1 <BR /> 9 10/29/2012 11:00 14% CHA-1H-0 <BR /> 10 10/29/2012 11:00 15% CHA-1H-3 </P> Mon, 29 Oct 2012 18:47:53 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Plotting-on-yaxis/m-p/105890#M5971 vikramnpanchal 2012-10-29T18:47:53Z https://community.splunk.com/t5/Dashboards-Visualizations/Plotting-on-yaxis/m-p/105891#M5972 <P>One of the tricks to charting is that Splunk requires one of the chart/timechart functions for the y-axis. In the example data above, you could use variety of different functions - I will use <CODE>max</CODE></P> <P>Second, you need to know the field names for your data. For this example, I will assume that Splunk has correctly identified the date/time of the event, and that you also have fields named <CODE>busy</CODE> and <CODE>processor</CODE></P> <PRE><CODE>yoursearchhere | eval busy = tonumber(replace(busy,"%","")) | timechart span=1h max(busy) by processor </CODE></PRE> Mon, 29 Oct 2012 20:32:00 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Plotting-on-yaxis/m-p/105891#M5972 lguinn2 2012-10-29T20:32:00Z