https://community.splunk.com/t5/Splunk-Search/Unable-to-get-graph-from-csv-data-input/m-p/348091#M175232 <P>I must have this data to be converted to graph. I have attached the csv. Is it possible?<BR /> When I try this it gives be strange spots in graph and below error also. <BR /> Steps I have followed:<BR /> 1. Created a new index in both index console and search head console.<BR /> 2. Uploaded the input (attached)<BR /> 3. Saved a new source type and followed the steps till review and submit.<BR /> 4. Clicked on searching and then I found its not as per my expectation.<BR /> <span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/2602i4789137684AF1CFD/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span><BR /> I have attached the desired graph. Can I get this from the attached data?</P> Wed, 08 Mar 2017 00:12:24 GMT kingshukm 2017-03-08T00:12:24Z https://community.splunk.com/t5/Splunk-Search/Unable-to-get-graph-from-csv-data-input/m-p/348091#M175232 <P>I must have this data to be converted to graph. I have attached the csv. Is it possible?<BR /> When I try this it gives be strange spots in graph and below error also. <BR /> Steps I have followed:<BR /> 1. Created a new index in both index console and search head console.<BR /> 2. Uploaded the input (attached)<BR /> 3. Saved a new source type and followed the steps till review and submit.<BR /> 4. Clicked on searching and then I found its not as per my expectation.<BR /> <span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/2602i4789137684AF1CFD/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span><BR /> I have attached the desired graph. Can I get this from the attached data?</P> Wed, 08 Mar 2017 00:12:24 GMT https://community.splunk.com/t5/Splunk-Search/Unable-to-get-graph-from-csv-data-input/m-p/348091#M175232 kingshukm 2017-03-08T00:12:24Z https://community.splunk.com/t5/Splunk-Search/Unable-to-get-graph-from-csv-data-input/m-p/348092#M175233 <P>Show a few sample events (lines in the CSV).</P> Wed, 08 Mar 2017 02:44:39 GMT https://community.splunk.com/t5/Splunk-Search/Unable-to-get-graph-from-csv-data-input/m-p/348092#M175233 woodcock 2017-03-08T02:44:39Z https://community.splunk.com/t5/Splunk-Search/Unable-to-get-graph-from-csv-data-input/m-p/348093#M175234 <P>Hi there!</P> <P>Splunk can definitely plot data over time, however you will need to use a statistical command like <CODE>| stats</CODE> or more likely for this case <CODE>| timechart</CODE> to generate the neccessary stats to chart.</P> <P>Splunk does not automagically spit out vizualization, just like excel requires you to build the vizualization you shared.</P> <P>Also in the sreenshot you shared Splunk is trying to help lead you to the answer by showing some ways to generate stats.</P> <P>I would suggest you check out some of our free online tutorials that will get you up to speed on using splunk, found here :</P> <P><A href="https://www.splunk.com/en_us/resources/getting-started.html">https://www.splunk.com/en_us/resources/getting-started.html</A></P> <P>In the meantime if you can share some sample rows of the csv we can help you get your timechart going...</P> Wed, 08 Mar 2017 13:22:03 GMT https://community.splunk.com/t5/Splunk-Search/Unable-to-get-graph-from-csv-data-input/m-p/348093#M175234 mattymo 2017-03-08T13:22:03Z https://community.splunk.com/t5/Splunk-Search/Unable-to-get-graph-from-csv-data-input/m-p/348094#M175235 <P>Average Best 5% Average Worst 5% Average<BR /> 1.19 0.85 2.19<BR /> 1.49 0.94 5.17<BR /> 1.33 0.94 2.91<BR /> 1.42 0.90 3.98<BR /> 1.41 0.94 3.56</P> Thu, 09 Mar 2017 05:51:43 GMT https://community.splunk.com/t5/Splunk-Search/Unable-to-get-graph-from-csv-data-input/m-p/348094#M175235 kingshukm 2017-03-09T05:51:43Z https://community.splunk.com/t5/Splunk-Search/Unable-to-get-graph-from-csv-data-input/m-p/348095#M175236 <P>Assuming that your events have a <CODE>_time</CODE> value, you should be able to do it like this:</P> <PRE><CODE>index=payment_history | table _time "Average Best 5%" "Average Worst 5%" Average | untable _time metric value | timechart span=YourSpanHere avg(value) BY metric </CODE></PRE> Thu, 09 Mar 2017 16:54:48 GMT https://community.splunk.com/t5/Splunk-Search/Unable-to-get-graph-from-csv-data-input/m-p/348095#M175236 woodcock 2017-03-09T16:54:48Z https://community.splunk.com/t5/Splunk-Search/Unable-to-get-graph-from-csv-data-input/m-p/348096#M175237 <P>Thanks. I am trying this,</P> Thu, 09 Mar 2017 22:23:23 GMT https://community.splunk.com/t5/Splunk-Search/Unable-to-get-graph-from-csv-data-input/m-p/348096#M175237 kingshukm 2017-03-09T22:23:23Z