topic Display all values (including duplicate values) in timechart graph in Splunk Search

Display all values (including duplicate values) in timechart graph

AKG1_old1 — Mon, 23 Oct 2017 16:31:14 GMT

Hello,

In my data, there could be multiple values(duration) for Scriptname. I am using Time Chart to display data and it should include all values including duplicates.

All Data

Time Chart

My Query:

eventtype=mlc_live host=TALANX_PostGoLive sourcetype=tool_lifecycle |  rex field="ScriptName" "^\S+_(?<ScriptName>[^\.]+)\.\S+" |  table _time Duration GROUPBY ScriptName UniqueIdentifier | dedup UniqueIdentifier | timechart max(Duration) BY ScriptName

Currently, I am using max function which include only one value. How can I display all events (including duplicates) in time chart graph.

Re: Display all values (including duplicate values) in timechart graph

elliotproebstel — Mon, 23 Oct 2017 16:55:05 GMT

I think you're looking for list() or values() instead of max(). Check out this documentation to help you decide which of those will work better for your use case:
http://docs.splunk.com/Documentation/Splunk/7.0.0/SearchReference/Multivaluefunctions

Re: Display all values (including duplicate values) in timechart graph

AKG1_old1 — Mon, 23 Oct 2017 17:01:08 GMT

Thanks for reply. I tried both list() and values() but these function will include all duplicate values in same row which wont be displayed on Graph.

Re: Display all values (including duplicate values) in timechart graph

cmerriman — Mon, 23 Oct 2017 17:22:52 GMT

try this instead of timechart, but i'm not sure if the visualization is going to like it or not.

|eval {ScriptName}=Duration
|fields - ScriptName Duration UniqueIdentifier

Re: Display all values (including duplicate values) in timechart graph

AKG1_old1 — Mon, 23 Oct 2017 17:28:18 GMT

trick worked for fetching all data but unfortunately not working visually. 😞