topic Need chart for two values in Splunk Search https://community.splunk.com/t5/Splunk-Search/Need-chart-for-two-values/m-p/34942#M7646 <P>Hi</P> <P>I have a basic XML file returning, Date-time value and a value in seconds see example("GmtDateTime":"2013-08-14 01:15:26","TotalSeconds":15.593). There is one value every 30 minutes. I need to have a column chart showing x - date-time and Y - TotalSeconds.</P> <P>I have tried a lot of different options today but can never get it showing correctly.<BR /> Just need a pointer in the correct direction</P> Wed, 14 Aug 2013 16:13:24 GMT edrad80 2013-08-14T16:13:24Z Need chart for two values https://community.splunk.com/t5/Splunk-Search/Need-chart-for-two-values/m-p/34942#M7646 <P>Hi</P> <P>I have a basic XML file returning, Date-time value and a value in seconds see example("GmtDateTime":"2013-08-14 01:15:26","TotalSeconds":15.593). There is one value every 30 minutes. I need to have a column chart showing x - date-time and Y - TotalSeconds.</P> <P>I have tried a lot of different options today but can never get it showing correctly.<BR /> Just need a pointer in the correct direction</P> Wed, 14 Aug 2013 16:13:24 GMT https://community.splunk.com/t5/Splunk-Search/Need-chart-for-two-values/m-p/34942#M7646 edrad80 2013-08-14T16:13:24Z Re: Need chart for two values https://community.splunk.com/t5/Splunk-Search/Need-chart-for-two-values/m-p/34943#M7647 <P>Provided you are having the fields correctly extracted, you can have |Timechart avg(TotalSeconds) OR Chart avg(TotalSeconds) by GmtDateTime.</P> <P>Just a table GmtDateTime,TotalSeconds. where your primary axis should be GmtDateTime and TotalSeconds can be secondary axis in <HIDDENCHARTFORMATTER> module for dashboard</HIDDENCHARTFORMATTER></P> <PRE><CODE>|Timechart span=30m avg(TotalSeconds) </CODE></PRE> <P>I have updated the answer, hope it works.</P> Wed, 14 Aug 2013 17:34:44 GMT https://community.splunk.com/t5/Splunk-Search/Need-chart-for-two-values/m-p/34943#M7647 linu1988 2013-08-14T17:34:44Z Re: Need chart for two values https://community.splunk.com/t5/Splunk-Search/Need-chart-for-two-values/m-p/34944#M7648 <P>It almost works, the GmtDateTime is correct but it shows the average TotalSeconds for all instances instead of the correct total</P> Thu, 15 Aug 2013 07:27:34 GMT https://community.splunk.com/t5/Splunk-Search/Need-chart-for-two-values/m-p/34944#M7648 edrad80 2013-08-15T07:27:34Z