https://community.splunk.com/t5/Splunk-Search/Transaction-event-charting-question/m-p/15338#M1860 <P>Have you tried using <A href="http://www.splunk.com/base/Documentation/latest/SearchReference/Xyseries" rel="nofollow">xyseries</A>?</P> <P>Another approach would be to use the <CODE>chart</CODE> command. You would still have to specify an aggregate function, but if you have only one value per transaction then the aggregate will return the original value anyways. So you could try:</P> <PRE><CODE>| chart sum(duration) by transaction_id </CODE></PRE> Sat, 12 Jun 2010 00:57:31 GMT Lowell 2010-06-12T00:57:31Z https://community.splunk.com/t5/Splunk-Search/Transaction-event-charting-question/m-p/15337#M1859 <P>I was wondering if it is possible to chart results on a per event basis. By this, I mean that I have defined a transaction in my search. Resulting fields from this search include how long an action took, and how many discreet units of work there was in the action. I want to be able to chart, per transactional event, how long and how many. Is this possible?</P> Fri, 11 Jun 2010 22:35:57 GMT https://community.splunk.com/t5/Splunk-Search/Transaction-event-charting-question/m-p/15337#M1859 ericrobinson 2010-06-11T22:35:57Z https://community.splunk.com/t5/Splunk-Search/Transaction-event-charting-question/m-p/15338#M1860 <P>Have you tried using <A href="http://www.splunk.com/base/Documentation/latest/SearchReference/Xyseries" rel="nofollow">xyseries</A>?</P> <P>Another approach would be to use the <CODE>chart</CODE> command. You would still have to specify an aggregate function, but if you have only one value per transaction then the aggregate will return the original value anyways. So you could try:</P> <PRE><CODE>| chart sum(duration) by transaction_id </CODE></PRE> Sat, 12 Jun 2010 00:57:31 GMT https://community.splunk.com/t5/Splunk-Search/Transaction-event-charting-question/m-p/15338#M1860 Lowell 2010-06-12T00:57:31Z https://community.splunk.com/t5/Splunk-Search/Transaction-event-charting-question/m-p/15339#M1861 <P>You mean per event along a timeline, by time of the transaction? Or just a table?</P> Sat, 12 Jun 2010 10:27:16 GMT https://community.splunk.com/t5/Splunk-Search/Transaction-event-charting-question/m-p/15339#M1861 gkanapathy 2010-06-12T10:27:16Z https://community.splunk.com/t5/Splunk-Search/Transaction-event-charting-question/m-p/15340#M1862 <P>Per event along a timeline.. the former. I am not interested in the duration perse.. I am using the transaction command to associate the tran_id.</P> Wed, 25 Aug 2010 03:36:45 GMT https://community.splunk.com/t5/Splunk-Search/Transaction-event-charting-question/m-p/15340#M1862 ericrobinson 2010-08-25T03:36:45Z