Archive

reverse axes

Explorer

I have a Splunk query that returns the duration of each service call, and I want to plot each value on the y-axis, and a time-stamp on the x-axis.

The last part of the query is a rex command parsing out DURATION

Tags (1)
0 Karma

Esteemed Legend

The simplest way is to use the transpose command.

0 Karma

SplunkTrust
SplunkTrust

1) One simple way to do this is to use a scatter plot, with _time along the bottom and a decimal calculated minutes or seconds as your vertical axis. This gives TIME as your more important factor, and shows events that are nearly simultaneous as such.

2) Another way is to flip your axes so that the _time is vertical with oldest at the top, and the bars go to the right for duration. This makes each event equal in importance, so that time (vertically) expands or compresses so that one vertical line is one event, no matter how many happened in one moment.

It all depends on your expected data and what you plan to be doing with the results.

0 Karma

SplunkTrust
SplunkTrust

You should be able to do that as long as you're keeping duration (y-axis value) numeric (can't plot strings). If you can share you current query, we can suggest the necessary changes for charting the data.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!