https://community.splunk.com/t5/Splunk-Search/How-to-display-a-chart-with-values-and-also-a-timechart-below/m-p/178702#M51412 <P>I'm trying to show a chart and need to show the actual values. At the same time I would like to display a linear timeline at the bottom of the chart. Using this search, my chart looks good.</P> <PRE><CODE>sourcetype="log_sort" host=myhost* | chart values(idle) by _time </CODE></PRE> <P>This works, but it does not display anything in the timechart at the bottom. I tried another search like this:</P> <PRE><CODE>| timechart values(idle) as "Idle Time" </CODE></PRE> <P>this shows the timechart at the bottom, but is trying to average my values. Many times my line will drop to 0 and I need to show that on the chart. Currently the avg might prevent this from happening. Any ideas?</P> Thu, 25 Jun 2015 19:35:10 GMT chadman 2015-06-25T19:35:10Z https://community.splunk.com/t5/Splunk-Search/How-to-display-a-chart-with-values-and-also-a-timechart-below/m-p/178702#M51412 <P>I'm trying to show a chart and need to show the actual values. At the same time I would like to display a linear timeline at the bottom of the chart. Using this search, my chart looks good.</P> <PRE><CODE>sourcetype="log_sort" host=myhost* | chart values(idle) by _time </CODE></PRE> <P>This works, but it does not display anything in the timechart at the bottom. I tried another search like this:</P> <PRE><CODE>| timechart values(idle) as "Idle Time" </CODE></PRE> <P>this shows the timechart at the bottom, but is trying to average my values. Many times my line will drop to 0 and I need to show that on the chart. Currently the avg might prevent this from happening. Any ideas?</P> Thu, 25 Jun 2015 19:35:10 GMT https://community.splunk.com/t5/Splunk-Search/How-to-display-a-chart-with-values-and-also-a-timechart-below/m-p/178702#M51412 chadman 2015-06-25T19:35:10Z https://community.splunk.com/t5/Splunk-Search/How-to-display-a-chart-with-values-and-also-a-timechart-below/m-p/178703#M51413 <P>I believe you are misunderstanding the <CODE>values</CODE> function and what you are really trying to do is something this:</P> <PRE><CODE> sourcetype="log_sort" host=myhost* | timechart span=5m avg(idle) as "Idle Time" </CODE></PRE> Fri, 26 Jun 2015 03:17:19 GMT https://community.splunk.com/t5/Splunk-Search/How-to-display-a-chart-with-values-and-also-a-timechart-below/m-p/178703#M51413 woodcock 2015-06-26T03:17:19Z https://community.splunk.com/t5/Splunk-Search/How-to-display-a-chart-with-values-and-also-a-timechart-below/m-p/178704#M51414 <P>Got it. When I used the values it just looked how I wanted it to. I think setting the span to a lower time would also help. My data is normally updated every min. My goal is to have the chart really indicate that it's 0 when that occurs and not an average. I think the span was being auto-scaled and that might be why my charts did not look right when I looked at data over a longer period of time.</P> Fri, 26 Jun 2015 15:22:25 GMT https://community.splunk.com/t5/Splunk-Search/How-to-display-a-chart-with-values-and-also-a-timechart-below/m-p/178704#M51414 chadman 2015-06-26T15:22:25Z https://community.splunk.com/t5/Splunk-Search/How-to-display-a-chart-with-values-and-also-a-timechart-below/m-p/178705#M51415 <P>OK, then something more like this:</P> <PRE><CODE>sourcetype="log_sort" host=myhost* | timechart span=1m max(idle) as "Idle Time" </CODE></PRE> <P>This way the <CODE>0</CODE> values of <CODE>Idle Time</CODE> indicate the gaps.</P> Fri, 26 Jun 2015 15:49:28 GMT https://community.splunk.com/t5/Splunk-Search/How-to-display-a-chart-with-values-and-also-a-timechart-below/m-p/178705#M51415 woodcock 2015-06-26T15:49:28Z https://community.splunk.com/t5/Splunk-Search/How-to-display-a-chart-with-values-and-also-a-timechart-below/m-p/178706#M51416 <P>That works great!</P> Fri, 26 Jun 2015 17:50:29 GMT https://community.splunk.com/t5/Splunk-Search/How-to-display-a-chart-with-values-and-also-a-timechart-below/m-p/178706#M51416 chadman 2015-06-26T17:50:29Z