I must have this data to be converted to graph. I have attached the csv. Is it possible?
When I try this it gives be strange spots in graph and below error also.
Steps I have followed:
1. Created a new index in both index console and search head console.
2. Uploaded the input (attached)
3. Saved a new source type and followed the steps till review and submit.
4. Clicked on searching and then I found its not as per my expectation.
I have attached the desired graph. Can I get this from the attached data?
Assuming that your events have a _time
value, you should be able to do it like this:
index=payment_history
| table _time "Average Best 5%" "Average Worst 5%" Average
| untable _time metric value
| timechart span=YourSpanHere avg(value) BY metric
Thanks. I am trying this,
Average Best 5% Average Worst 5% Average
1.19 0.85 2.19
1.49 0.94 5.17
1.33 0.94 2.91
1.42 0.90 3.98
1.41 0.94 3.56
Hi there!
Splunk can definitely plot data over time, however you will need to use a statistical command like | stats
or more likely for this case | timechart
to generate the neccessary stats to chart.
Splunk does not automagically spit out vizualization, just like excel requires you to build the vizualization you shared.
Also in the sreenshot you shared Splunk is trying to help lead you to the answer by showing some ways to generate stats.
I would suggest you check out some of our free online tutorials that will get you up to speed on using splunk, found here :
https://www.splunk.com/en_us/resources/getting-started.html
In the meantime if you can share some sample rows of the csv we can help you get your timechart going...
Show a few sample events (lines in the CSV).