https://community.splunk.com/t5/Splunk-Search/Plot-unique-value-in-Timechart/m-p/195453#M56341 <P>Hello team.</P> <P>I need to plot only one value in my timechart.<BR /> I am using the next search string:</P> <P>search...|timechart span=1d sum(GB) as sgb by index | addtotals</P> <P>The values that I'm obtaining are in table mode like this:</P> <P>_time index1 index2 index3 index4 Total</P> <P>Each column has one value for each time and each index. When I select mode graph all the values are graphed.</P> <P>I need create one graph for only one value (for example index1 versus time)</P> <P>Thanks and regards.</P> Wed, 19 Mar 2014 21:38:21 GMT rponcel 2014-03-19T21:38:21Z https://community.splunk.com/t5/Splunk-Search/Plot-unique-value-in-Timechart/m-p/195453#M56341 <P>Hello team.</P> <P>I need to plot only one value in my timechart.<BR /> I am using the next search string:</P> <P>search...|timechart span=1d sum(GB) as sgb by index | addtotals</P> <P>The values that I'm obtaining are in table mode like this:</P> <P>_time index1 index2 index3 index4 Total</P> <P>Each column has one value for each time and each index. When I select mode graph all the values are graphed.</P> <P>I need create one graph for only one value (for example index1 versus time)</P> <P>Thanks and regards.</P> Wed, 19 Mar 2014 21:38:21 GMT https://community.splunk.com/t5/Splunk-Search/Plot-unique-value-in-Timechart/m-p/195453#M56341 rponcel 2014-03-19T21:38:21Z https://community.splunk.com/t5/Splunk-Search/Plot-unique-value-in-Timechart/m-p/195454#M56342 <P>The best way would be to specify the index in your search</P> <PRE><CODE>yoursearchhere index=index1 | timechart span=1d sum(GB) as sgb </CODE></PRE> <P>There is no way AFAIK to have the table view show all the indexes and yet have the chart show only one index.</P> Wed, 19 Mar 2014 23:07:06 GMT https://community.splunk.com/t5/Splunk-Search/Plot-unique-value-in-Timechart/m-p/195454#M56342 lguinn2 2014-03-19T23:07:06Z