https://community.splunk.com/t5/Splunk-Search/chart-values-from-search/m-p/143272#M39786 <P>If possible, add the answer that you arrived to here and accept/close the answer.</P> Fri, 25 Apr 2014 19:36:16 GMT somesoni2 2014-04-25T19:36:16Z https://community.splunk.com/t5/Splunk-Search/chart-values-from-search/m-p/143269#M39783 <P>I have a search that returns time as this:</P> <P>Apr 25 2014 14:51:40 GMT: INFO (nsup): (base/thr_nsup.c:1249) {ddp-ns} Records: 17798730, 17798730 0-vt, 0(0) expired, 0(0) evicted, 0(0) set deletes, 0(0) set evicted. Evict ttls: 0,0,0.000. Waits: 0,0,0. Total time: 3169 ms</P> <P>I would like to chart this total time over time but not having luck. thanks.</P> Fri, 25 Apr 2014 14:58:25 GMT https://community.splunk.com/t5/Splunk-Search/chart-values-from-search/m-p/143269#M39783 sreynolds30 2014-04-25T14:58:25Z https://community.splunk.com/t5/Splunk-Search/chart-values-from-search/m-p/143270#M39784 <P>This one event that you're indexing in splunk or output of a search? You could extract Total time in a field and do a timechart.</P> Fri, 25 Apr 2014 17:36:32 GMT https://community.splunk.com/t5/Splunk-Search/chart-values-from-search/m-p/143270#M39784 somesoni2 2014-04-25T17:36:32Z https://community.splunk.com/t5/Splunk-Search/chart-values-from-search/m-p/143271#M39785 <P>I got it going thanks.</P> Fri, 25 Apr 2014 18:04:18 GMT https://community.splunk.com/t5/Splunk-Search/chart-values-from-search/m-p/143271#M39785 sreynolds30 2014-04-25T18:04:18Z https://community.splunk.com/t5/Splunk-Search/chart-values-from-search/m-p/143272#M39786 <P>If possible, add the answer that you arrived to here and accept/close the answer.</P> Fri, 25 Apr 2014 19:36:16 GMT https://community.splunk.com/t5/Splunk-Search/chart-values-from-search/m-p/143272#M39786 somesoni2 2014-04-25T19:36:16Z