topic Line Chart single value over time in Splunk Search

Line Chart single value over time

Blackninja5431 — Tue, 21 Aug 2012 13:56:40 GMT

I have a log containing memory usage over a period of time. How can I plot a line graph where the x-axis is the time, and the y-axis is the amount of memory used at that time.

Re: Line Chart single value over time

Ayn — Tue, 21 Aug 2012 14:54:59 GMT

If you want to grab each data point, just using table with the fields _time and your field containing the memory info will do. Let's say the field is called memory_used:

... | table _time memory_used

After that, choose the chart view and apply the appropriate settings.

If you have loads of data points there is a risk of overwhelming the chart module with more points than it can handle. In that case, use timechart and some kind of statistical function for representing values in a certain time interval, like first, max or avg. You need to supply some kind of statistical function because timechart divides the events into discrete sets of time intervals, and it needs to know how to handle if there is more than 1 event in an interval.

... | timechart avg(memory_used)

Re: Line Chart single value over time

sam_jacob — Thu, 16 Jul 2015 19:52:29 GMT

After tabulating the data, what settings do you use for chart? I have the table needed to chart by two different fields, but how do I chart Field A by Field B?