https://community.splunk.com/t5/Splunk-Search/How-to-create-a-line-graph-where-for-each-day-it-displays-the/m-p/183840#M52928 <P>Hello,</P> <P>I extracted the time with the variable TIME. I am trying to create a line graph where it shows the latest time. My search right now is </P> <PRE><CODE>host=... source=... | timechart max(TIME) by Date </CODE></PRE> <P>However, my y-axis' values are odd. It goes from 7,000 to 10,000, but the x-axis is correct with the dates. </P> Fri, 21 Aug 2015 19:28:56 GMT alanxu 2015-08-21T19:28:56Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-line-graph-where-for-each-day-it-displays-the/m-p/183840#M52928 <P>Hello,</P> <P>I extracted the time with the variable TIME. I am trying to create a line graph where it shows the latest time. My search right now is </P> <PRE><CODE>host=... source=... | timechart max(TIME) by Date </CODE></PRE> <P>However, my y-axis' values are odd. It goes from 7,000 to 10,000, but the x-axis is correct with the dates. </P> Fri, 21 Aug 2015 19:28:56 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-line-graph-where-for-each-day-it-displays-the/m-p/183840#M52928 alanxu 2015-08-21T19:28:56Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-line-graph-where-for-each-day-it-displays-the/m-p/183841#M52929 <P>I changed it to chart latest(TIME) by Date and that chart that is given is perfect.. However the line graph is still off</P> Fri, 21 Aug 2015 19:36:46 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-line-graph-where-for-each-day-it-displays-the/m-p/183841#M52929 alanxu 2015-08-21T19:36:46Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-line-graph-where-for-each-day-it-displays-the/m-p/183842#M52930 <P>In What format you're extracting the TIME value? Can you run something like this and share result?</P> <PRE><CODE> host=... source=... | head 1 | table TIME </CODE></PRE> Fri, 21 Aug 2015 19:39:45 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-line-graph-where-for-each-day-it-displays-the/m-p/183842#M52930 somesoni2 2015-08-21T19:39:45Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-line-graph-where-for-each-day-it-displays-the/m-p/183843#M52931 <P>Even though it was for 7 days I only got one value... 02:40:59 which is probably the largest value of time in the 7 days</P> Fri, 21 Aug 2015 19:44:07 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-line-graph-where-for-each-day-it-displays-the/m-p/183843#M52931 alanxu 2015-08-21T19:44:07Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-line-graph-where-for-each-day-it-displays-the/m-p/183844#M52932 <P>Its really odd that the table is perfect, but the line graph is always wrong</P> Fri, 21 Aug 2015 19:46:06 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-line-graph-where-for-each-day-it-displays-the/m-p/183844#M52932 alanxu 2015-08-21T19:46:06Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-line-graph-where-for-each-day-it-displays-the/m-p/183845#M52933 <P>It could be because you're plotting string values in Y-axis. You want to plot the max time of the day in HH:MM:SS format for each day (last 7 day)?</P> Fri, 21 Aug 2015 20:04:39 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-line-graph-where-for-each-day-it-displays-the/m-p/183845#M52933 somesoni2 2015-08-21T20:04:39Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-line-graph-where-for-each-day-it-displays-the/m-p/183846#M52934 <P>yes for each day! Exactly</P> Fri, 21 Aug 2015 20:07:13 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-line-graph-where-for-each-day-it-displays-the/m-p/183846#M52934 alanxu 2015-08-21T20:07:13Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-line-graph-where-for-each-day-it-displays-the/m-p/183847#M52935 <P>Oh they are string values? </P> Fri, 21 Aug 2015 20:08:08 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-line-graph-where-for-each-day-it-displays-the/m-p/183847#M52935 alanxu 2015-08-21T20:08:08Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-line-graph-where-for-each-day-it-displays-the/m-p/183848#M52936 <P>I would need your full current query to confirm the same..</P> Fri, 21 Aug 2015 20:09:21 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-line-graph-where-for-each-day-it-displays-the/m-p/183848#M52936 somesoni2 2015-08-21T20:09:21Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-line-graph-where-for-each-day-it-displays-the/m-p/183849#M52937 <P>I can send you a picture of the table that comes up</P> Fri, 21 Aug 2015 20:10:42 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-line-graph-where-for-each-day-it-displays-the/m-p/183849#M52937 alanxu 2015-08-21T20:10:42Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-line-graph-where-for-each-day-it-displays-the/m-p/183850#M52938 <P>That will work too. <A href="mailto:somesh.soni@gmail.com">somesh.soni@gmail.com</A></P> Fri, 21 Aug 2015 20:11:30 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-line-graph-where-for-each-day-it-displays-the/m-p/183850#M52938 somesoni2 2015-08-21T20:11:30Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-line-graph-where-for-each-day-it-displays-the/m-p/183851#M52939 <P>sent the picture!</P> Fri, 21 Aug 2015 20:15:01 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-line-graph-where-for-each-day-it-displays-the/m-p/183851#M52939 alanxu 2015-08-21T20:15:01Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-line-graph-where-for-each-day-it-displays-the/m-p/183852#M52940 <P>Look at the second email instead</P> Fri, 21 Aug 2015 20:17:33 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-line-graph-where-for-each-day-it-displays-the/m-p/183852#M52940 alanxu 2015-08-21T20:17:33Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-line-graph-where-for-each-day-it-displays-the/m-p/183853#M52941 <P>As suspected, there are string values (propably output of command like <CODE>| eval TIME=strftime(_time ,"%H:%M:%S")</CODE> . The workaround that you can try would be like this</P> <PRE><CODE> | eval TIME=tonumber(strftime(_time ,"%H.%M")) | timechart max(TIME) as TIME by Date </CODE></PRE> Fri, 21 Aug 2015 20:21:19 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-line-graph-where-for-each-day-it-displays-the/m-p/183853#M52941 somesoni2 2015-08-21T20:21:19Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-line-graph-where-for-each-day-it-displays-the/m-p/183854#M52942 <P>Sent you screenshot of result with same query I used.</P> Fri, 21 Aug 2015 20:21:34 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-line-graph-where-for-each-day-it-displays-the/m-p/183854#M52942 somesoni2 2015-08-21T20:21:34Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-line-graph-where-for-each-day-it-displays-the/m-p/183855#M52943 <P>For some reason I get numbers like 9.3, 8.6, 9.05</P> Fri, 21 Aug 2015 20:26:14 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-line-graph-where-for-each-day-it-displays-the/m-p/183855#M52943 alanxu 2015-08-21T20:26:14Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-line-graph-where-for-each-day-it-displays-the/m-p/183856#M52944 <P>I want the time like 1:50:SS to be on the y axis </P> Fri, 21 Aug 2015 20:27:23 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-line-graph-where-for-each-day-it-displays-the/m-p/183856#M52944 alanxu 2015-08-21T20:27:23Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-line-graph-where-for-each-day-it-displays-the/m-p/183857#M52945 <P>And TIME is already the field I extracted.. In the log it contains the HH:MM</P> Fri, 21 Aug 2015 20:29:55 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-line-graph-where-for-each-day-it-displays-the/m-p/183857#M52945 alanxu 2015-08-21T20:29:55Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-line-graph-where-for-each-day-it-displays-the/m-p/183858#M52946 <P>I am trying to have..<BR /> y-axis have a range of times<BR /> x-axis have dates</P> <P>then it will be plotting the latest time for each date.</P> Fri, 21 Aug 2015 20:31:47 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-line-graph-where-for-each-day-it-displays-the/m-p/183858#M52946 alanxu 2015-08-21T20:31:47Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-line-graph-where-for-each-day-it-displays-the/m-p/183859#M52947 <P>Yes, that's the work around, instead of HH:MM:SS in string format, we can convert it to HH.MM (HH dot MM) i.e. decimal value which can be plotted . I know it would not look good for Tables but decent work around for graphs. Do you intent to put this in dashboard??</P> <P>If this workaround is acceptable to you, I can tell the option to convert your already existing TIME field to decimal value.</P> Fri, 21 Aug 2015 20:33:41 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-line-graph-where-for-each-day-it-displays-the/m-p/183859#M52947 somesoni2 2015-08-21T20:33:41Z