Dashboards & Visualizations

How Can I do a simple line graph?

bruno_eduardo
Path Finder

Hi,

How Can I do a simple line graph, here is an example:

I got four Fields ( Fruits, June, July, August), like this
alt text

and I want on XAxis( June, July, August) and each fruit must be a serie, like this:
alt text

So there is no time fields on this one, so probably I need to use |chart

1 Solution

somesoni2
Revered Legend

Assuming your data or base search gives a table like in the question, they try this

your base search | table Fruits, June, July, August  | untable Fruits Months Value | chart first(Value) over Month by Fruits

Use the line chart as visualization.

View solution in original post

sandyjov1
Explorer

Can someone explain exactly what is happening when using untable?

 

0 Karma

afishkin_splunk
Splunk Employee
Splunk Employee

search should have
| timechart count by fruit

to show line chart
<option name="charting.chart">line</option>

to split series
<option name="charting.layout.splitSeries">1</option>

to show independent Y-Axis ranges
<option name="charting.layout.splitSeries.allowIndependentYRanges">1</option>

0 Karma

somesoni2
Revered Legend

Assuming your data or base search gives a table like in the question, they try this

your base search | table Fruits, June, July, August  | untable Fruits Months Value | chart first(Value) over Month by Fruits

Use the line chart as visualization.

bruno_eduardo
Path Finder

That is it!!! well almost, the only thing is: How can I change the order of the months? because, right now is like August -> July -> June!! need to be June -> July -> August.

0 Karma

bruno_eduardo
Path Finder

I got it: | sort str(Months) desc

Thank you very much, could you please explain every step?

One more thing, you forgot to put 's' on """""| chart first(Value) over Month"""", can you correct?, is better if someone falls here.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk on November 6 at 11AM PT, and empower your SOC to reach new heights! Duration: ...

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...