topic Re: How can I display these rows of data in a line chart? in Splunk Search

How can I display these rows of data in a line chart?

flzhang132 — Wed, 08 Aug 2018 10:42:40 GMT

There are 5 rows of data in the table. I want to display these 5 rows of data a line chart.
There are 4 fields, field 1 for time, field 2 for host ID, field 3 for metric type, field 4 for numeric value.
I want to show the usage rate and memory usage of CPU in a picture, using the way of polygon graph.
Excuse me, how to realize

Re: How can I display these rows of data in a line chart?

renjith_nair — Wed, 08 Aug 2018 13:13:31 GMT

Try

"your search to return the fields"| stats max(numerical_value) by _time,host_ID,metric_type

and select "line" visualization

e.g

<dashboard>
  <label>TEST</label>
  <row>
    <panel>
      <chart>
        <search>
          <query>index=_introspection sourcetype=splunk_resource_usage  data.pct_cpu=*|table _time,data.process,sourcetype,data.pct_cpu
|stats max(data.pct_cpu) by _time,data.process,sourcetype</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="charting.chart">line</option>
        <option name="charting.drilldown">all</option>
      </chart>
    </panel>
  </row>
</dashboard>

Re: How can I display these rows of data in a line chart?

flzhang132 — Wed, 08 Aug 2018 13:48:56 GMT

I want to display these 5 rows of data a line chart. and can not used a aggregate function （ex. max）

Re: How can I display these rows of data in a line chart?

renjith_nair — Wed, 08 Aug 2018 14:06:56 GMT

if those 5 lines are unique by time and other fields, you still get those values irrespective of the aggregation function. Instead of max, you could use `values

Re: How can I display these rows of data in a line chart?

niketn — Wed, 08 Aug 2018 19:47:04 GMT

@flzhang132 while your actual requirement would only be clear only after you can provide more details on the type of output you want.

Do check out the following answers which talks about two options i.e. to use Event Annotations available from Splunk Enterprise 7.0 onward or else to add details to Tooltip text using answer by @jeffland

https://answers.splunk.com/answers/613705/using-dashboard-for-presentation.html