https://community.splunk.com/t5/Reporting/how-to-speedup-search-machine-data/m-p/118567#M2671 <P>Why would you want to use <CODE>timechart</CODE> to feed a gauge? <CODE>timechart</CODE> gives you a series of values, for example one per minute, that's often charted using columns, lines, or areas. A gauge only displays one value.</P> <P>The more important question is, what's your use case?</P> Thu, 03 Apr 2014 08:13:55 GMT martin_mueller 2014-04-03T08:13:55Z https://community.splunk.com/t5/Reporting/how-to-speedup-search-machine-data/m-p/118564#M2668 <P>Hello everyone... <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> <P>My Data is under type...<BR /> |TAG01|TAG02|TAG03|<BR /> |434.1|444.0|42.7|<BR /> |420.1|424.5|40.6|<BR /> |470.3|453.8|43.5|<BR /> |452.6|413.6|40.4|<BR /> |429.3|419.3|44.7|</P> <P>I'd like to check realtime data in Splunk Gauge, So, I use this search <BR /> "index=myindex | timechart latest(TAG01)"</P> <P>How to speedup search?</P> <P>If use accelation Report, Can i use latest or first?</P> <P>Thanks.</P> Thu, 03 Apr 2014 07:37:43 GMT https://community.splunk.com/t5/Reporting/how-to-speedup-search-machine-data/m-p/118564#M2668 ugy 2014-04-03T07:37:43Z https://community.splunk.com/t5/Reporting/how-to-speedup-search-machine-data/m-p/118565#M2669 <P>If you're just displaying a single value, you should be able to speed up your realtime search like this:</P> <PRE><CODE>index=myindex TAG01=* | tail 1 | table TAG01 </CODE></PRE> Thu, 03 Apr 2014 07:52:21 GMT https://community.splunk.com/t5/Reporting/how-to-speedup-search-machine-data/m-p/118565#M2669 martin_mueller 2014-04-03T07:52:21Z https://community.splunk.com/t5/Reporting/how-to-speedup-search-machine-data/m-p/118566#M2670 <P>First of all <BR /> Thank you for your answer.</P> <P>If i'd like to use timechart or Accelation Report, how to use search?</P> Thu, 03 Apr 2014 08:09:38 GMT https://community.splunk.com/t5/Reporting/how-to-speedup-search-machine-data/m-p/118566#M2670 ugy 2014-04-03T08:09:38Z https://community.splunk.com/t5/Reporting/how-to-speedup-search-machine-data/m-p/118567#M2671 <P>Why would you want to use <CODE>timechart</CODE> to feed a gauge? <CODE>timechart</CODE> gives you a series of values, for example one per minute, that's often charted using columns, lines, or areas. A gauge only displays one value.</P> <P>The more important question is, what's your use case?</P> Thu, 03 Apr 2014 08:13:55 GMT https://community.splunk.com/t5/Reporting/how-to-speedup-search-machine-data/m-p/118567#M2671 martin_mueller 2014-04-03T08:13:55Z https://community.splunk.com/t5/Reporting/how-to-speedup-search-machine-data/m-p/118568#M2672 <P>I have two issue.<BR /> First Gauge View, Two Linechart View.<BR /> So, I have to use timechart.<BR /> Your First answer for Gauge View. Thank you.<BR /> I'd like to view Long time for timechart. So, I asked about timechart and accelation report.</P> <P>Anyway! Your answer is Helpfull to me.<BR /> Thank you.</P> Thu, 03 Apr 2014 09:40:37 GMT https://community.splunk.com/t5/Reporting/how-to-speedup-search-machine-data/m-p/118568#M2672 ugy 2014-04-03T09:40:37Z https://community.splunk.com/t5/Reporting/how-to-speedup-search-machine-data/m-p/118569#M2673 <P>For a line chart you're probably looking for something like this:</P> <PRE><CODE>index=myindex TAG01=* | timechart avg(TAG01) </CODE></PRE> <P>Report Acceleration can be enabled for this if you need to.</P> Thu, 03 Apr 2014 09:48:24 GMT https://community.splunk.com/t5/Reporting/how-to-speedup-search-machine-data/m-p/118569#M2673 martin_mueller 2014-04-03T09:48:24Z