topic Re: splunk report in Splunk Search

splunk report

rameshlpatel — Mon, 07 Apr 2014 15:33:16 GMT

Hi,

I have timeDif values(Time diffrence between start and stop) which I want to point in chart with time period.

please help me.

Re: splunk report

martin_mueller — Mon, 07 Apr 2014 17:40:26 GMT

Do elaborate more on your data and the desired results.

Re: splunk report

rameshlpatel — Tue, 08 Apr 2014 13:05:16 GMT

I have the values(milliseconds) which I am getting from logs. In chart In X axis=Time period and in Y axis=milliseconds.

In this i need line chart which goes up and down based on milliseconds value coming from logs.

Re: splunk report

martin_mueller — Tue, 08 Apr 2014 13:21:09 GMT

So..... something like this?

base search | timechart avg(milliseconds)

Set the visualization to line charts.

Re: splunk report

rameshlpatel — Tue, 08 Apr 2014 13:23:52 GMT

Thanks for your answer,I tried but its not working.

Re: splunk report

martin_mueller — Tue, 08 Apr 2014 13:24:36 GMT

In what way?

Re: splunk report

rameshlpatel — Tue, 08 Apr 2014 16:16:15 GMT

Its not showing any line in chart

Re: splunk report

martin_mueller — Tue, 08 Apr 2014 16:41:20 GMT

Make sure you're using the correct field name in the avg(fieldname) call.

Re: splunk report

rameshlpatel — Wed, 09 Apr 2014 11:40:05 GMT

Yes I am doing..

Re: splunk report

somesoni2 — Wed, 09 Apr 2014 13:05:25 GMT

Could you please share your current query and sample output of that query? It would be lot easier to provide suggestion if we can see what you see.

Re: splunk report

rameshlpatel — Wed, 09 Apr 2014 13:14:24 GMT

index="OCSDEV" | timechart avg(timeDiff)

Here timeDiff ( in milliseconds) is field I am extracting from the logs.

Re: splunk report

martin_mueller — Wed, 09 Apr 2014 16:12:40 GMT

Does that field contain numeric values?

Posting some sample data would indeed make it a lot easier than stabbing in the dark.

Re: splunk report

jhowkins — Wed, 09 Apr 2014 17:56:58 GMT

I suspect you're only getting single points on the linechart but they are not connected. If this is the case, try the following;

Assuming you've already set your chart type to "Line"...
- Click "Format" to the upper left of the chart on the Visualization tab
- From the General tab, click the "Connect" button (right-most) next to "Null Values"
- Click Apply and your linechart will have connected dots

If your events are not continuous, you could also acheive the same thing by setting cont=f ...

... | timechart cont=f avg(timeDiff)

I've made some assumptions here. Hopefully I answered your question -- if not, I'd need more detail... a screenshot is always nice.

Re: splunk report

jhowkins — Thu, 10 Apr 2014 17:28:28 GMT

Take a look at the solutions I've provided below. Let me know if that works for you.