Creating per-server report

[neil_craig]

Hello all

I'm trying to create a report in Splunk (4.3.4). I can get the fields i want into a table but can't format a graph in the way i would like, this is what i'd really appreciate help with.

So i am ending up with 3 fields:
datetime (e.g. "2012-12-11 09:01:02")
serverName (e.g. "clientRef-host1")
numErrors (e.g. 1234)

What i would like is to have a line chart (although another type is fine if it displays the information logically) which shows:
x axis: datetime
y axis: numErrors
Lines: one line per serverName

If anyone can offer advice on how to achieve this, i'd be very grateful - i though it would be simple but it's eluded me thus far!

Many thanks
Neil

[lguinn2]

Here's one idea:

... | timechart span=1h sum(numErrors) as ErrorCount by serverName 

This will show one line for each server. Each point on the line will represent one hour of errors.

If you want more suggestions, we need a little more information, like - how did you get the three fields? What does the source look like?

HTH!