Dashboards & Visualizations

How Can I do a simple line graph?

bruno_eduardo
Path Finder

Hi,

How Can I do a simple line graph, here is an example:

I got four Fields ( Fruits, June, July, August), like this
alt text

and I want on XAxis( June, July, August) and each fruit must be a serie, like this:
alt text

So there is no time fields on this one, so probably I need to use |chart

1 Solution

somesoni2
Revered Legend

Assuming your data or base search gives a table like in the question, they try this

your base search | table Fruits, June, July, August  | untable Fruits Months Value | chart first(Value) over Month by Fruits

Use the line chart as visualization.

View solution in original post

sandyjov1
Explorer

Can someone explain exactly what is happening when using untable?

 

0 Karma

afishkin_splunk
Splunk Employee
Splunk Employee

search should have
| timechart count by fruit

to show line chart
<option name="charting.chart">line</option>

to split series
<option name="charting.layout.splitSeries">1</option>

to show independent Y-Axis ranges
<option name="charting.layout.splitSeries.allowIndependentYRanges">1</option>

0 Karma

somesoni2
Revered Legend

Assuming your data or base search gives a table like in the question, they try this

your base search | table Fruits, June, July, August  | untable Fruits Months Value | chart first(Value) over Month by Fruits

Use the line chart as visualization.

bruno_eduardo
Path Finder

That is it!!! well almost, the only thing is: How can I change the order of the months? because, right now is like August -> July -> June!! need to be June -> July -> August.

0 Karma

bruno_eduardo
Path Finder

I got it: | sort str(Months) desc

Thank you very much, could you please explain every step?

One more thing, you forgot to put 's' on """""| chart first(Value) over Month"""", can you correct?, is better if someone falls here.

0 Karma
Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...