Dashboards & Visualizations

How Can I do a simple line graph?

bruno_eduardo
Path Finder

Hi,

How Can I do a simple line graph, here is an example:

I got four Fields ( Fruits, June, July, August), like this
alt text

and I want on XAxis( June, July, August) and each fruit must be a serie, like this:
alt text

So there is no time fields on this one, so probably I need to use |chart

1 Solution

somesoni2
Revered Legend

Assuming your data or base search gives a table like in the question, they try this

your base search | table Fruits, June, July, August  | untable Fruits Months Value | chart first(Value) over Month by Fruits

Use the line chart as visualization.

View solution in original post

sandyjov1
Explorer

Can someone explain exactly what is happening when using untable?

 

0 Karma

afishkin_splunk
Splunk Employee
Splunk Employee

search should have
| timechart count by fruit

to show line chart
<option name="charting.chart">line</option>

to split series
<option name="charting.layout.splitSeries">1</option>

to show independent Y-Axis ranges
<option name="charting.layout.splitSeries.allowIndependentYRanges">1</option>

0 Karma

somesoni2
Revered Legend

Assuming your data or base search gives a table like in the question, they try this

your base search | table Fruits, June, July, August  | untable Fruits Months Value | chart first(Value) over Month by Fruits

Use the line chart as visualization.

bruno_eduardo
Path Finder

That is it!!! well almost, the only thing is: How can I change the order of the months? because, right now is like August -> July -> June!! need to be June -> July -> August.

0 Karma

bruno_eduardo
Path Finder

I got it: | sort str(Months) desc

Thank you very much, could you please explain every step?

One more thing, you forgot to put 's' on """""| chart first(Value) over Month"""", can you correct?, is better if someone falls here.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Meet the .conf26 AI Agent Buildathon Winners

At the .conf26 AI Agent Buildathon, Splunk users turned their operational expertise into working AI agents ...

Trusted Autonomy in the SOC: A Maturity Journey

AI is compressing attacker timelines and pushing SOC teams beyond human capacity thresholds. The next SOC ...

Supercharging Windows Security Detection Performance: Introducing Hybrid Field ...

Windows event logs—from Security auditing and Sysmon to PowerShell script blocks—form the operational backbone ...