topic Multiple data series in line chart - dashboard visualization in Dashboards & Visualizations

Multiple data series in line chart - dashboard visualization

parth_jec — Thu, 26 Jul 2012 18:44:14 GMT

I am trying to display data in the form of line chart in dashboard. Each line in the chart should represent a separate series. For ex: one series would show number of events "string1" appears in index i1 and other series be number of events "string2" appears in the same index i1.

For one data series I can write in the search bar something like:

index = i1 string1 | timechart count by event

How can I incorporate string 2 in this such that for each string the count of events in which the strings appear can be represented by two different lines in a chart in dashboard?

Thanks,

Re: Multiple data series in line chart - dashboard visualization

sdaniels — Thu, 26 Jul 2012 19:06:16 GMT

Updated:

The docs had been updated and I don't have the exact page but here are some references:

http://docs.splunk.com/Documentation/Splunk/5.0.4/SearchReference/Timechart#Example_5

http://answers.splunk.com/answers/5990/multiple-series-line-chart-dashboard

http://answers.splunk.com/answers/55032/multi-line-graph-from-multiple-hosts

Re: Multiple data series in line chart - dashboard visualization

parth_jec — Thu, 26 Jul 2012 21:37:15 GMT

Thanks for the link. I checked it but I am not getting clearly how its done.

I want to search for multiple strings in an index, calculate count of events separately in which the strigs appear and then plot them in a chart.

The example in the link does not show how can I search for a string and plot it in chart. Ex: index = i1 string1 "String 1 " | stats count
This will give the number events in index i1 where "String 1" is present. How can implement this using the example given in the link?
Thanks

Re: Multiple data series in line chart - dashboard visualization

sdaniels — Fri, 27 Jul 2012 01:48:48 GMT

I think what you want is multiple stats operations...one for each field. Or maybe i'm missing something?

... | stats count(field1) count(field2) avg(field3)

Re: Multiple data series in line chart - dashboard visualization

parth_jec — Fri, 27 Jul 2012 16:28:06 GMT

do I have to create fields for each of the string I want to search (string1, string2) first?

Re: Multiple data series in line chart - dashboard visualization

sdaniels — Fri, 27 Jul 2012 16:32:11 GMT

Yes, you'll need fields for those values you want to count.

Re: Multiple data series in line chart - dashboard visualization

parth_jec — Fri, 27 Jul 2012 20:31:46 GMT

I am trying to create field (key/value) pairs for string1 and string2 interactively following http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/ExtractfieldsinteractivelywithIFX
For string1 I am able to create a field but for string2 splunk is not allowing me to create field, it does not creates regex for the second string, is there another way to create fields? Also, I was wondering since I know there will be only one value associated with each of the fields I create, is creating fields the only way to do it? ex: field s1="String1" and s2="String2" always.

Re: Multiple data series in line chart - dashboard visualization

benspader — Wed, 21 Aug 2013 12:47:40 GMT

Is it just me or do none of these links work??? What am I doing wrong? It brings me to a page that says only this is a special page...

Re: Multiple data series in line chart - dashboard visualization

sdaniels — Wed, 21 Aug 2013 13:22:13 GMT

You are correct. Updating now. Looks like references were changed in the online docs.

Re: Multiple data series in line chart - dashboard visualization

arungeorge09 — Fri, 06 Sep 2013 07:34:37 GMT

Multiline data series not working with Splunk . I tried a simple timchart count by host and dashboard is not supporting this query. When I schedule pdf delivery it just shows as blank.

Re: Multiple data series in line chart - dashboard visualization

sdaniels — Fri, 06 Sep 2013 11:39:44 GMT

Sounds like you need to post a new question with your specific challenge.