Dashboards & Visualizations

How Can I do a simple line graph?

bruno_eduardo
Path Finder

Hi,

How Can I do a simple line graph, here is an example:

I got four Fields ( Fruits, June, July, August), like this
alt text

and I want on XAxis( June, July, August) and each fruit must be a serie, like this:
alt text

So there is no time fields on this one, so probably I need to use |chart

1 Solution

somesoni2
Revered Legend

Assuming your data or base search gives a table like in the question, they try this

your base search | table Fruits, June, July, August  | untable Fruits Months Value | chart first(Value) over Month by Fruits

Use the line chart as visualization.

View solution in original post

sandyjov1
Explorer

Can someone explain exactly what is happening when using untable?

 

0 Karma

afishkin_splunk
Splunk Employee
Splunk Employee

search should have
| timechart count by fruit

to show line chart
<option name="charting.chart">line</option>

to split series
<option name="charting.layout.splitSeries">1</option>

to show independent Y-Axis ranges
<option name="charting.layout.splitSeries.allowIndependentYRanges">1</option>

0 Karma

somesoni2
Revered Legend

Assuming your data or base search gives a table like in the question, they try this

your base search | table Fruits, June, July, August  | untable Fruits Months Value | chart first(Value) over Month by Fruits

Use the line chart as visualization.

bruno_eduardo
Path Finder

That is it!!! well almost, the only thing is: How can I change the order of the months? because, right now is like August -> July -> June!! need to be June -> July -> August.

0 Karma

bruno_eduardo
Path Finder

I got it: | sort str(Months) desc

Thank you very much, could you please explain every step?

One more thing, you forgot to put 's' on """""| chart first(Value) over Month"""", can you correct?, is better if someone falls here.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Agent Mode Engaged! Enchaining Agentic Operations with Splunk AI Assistant 2.0

    Are you ready to transform how your team handles complex data requests? We invite you to our upcoming ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

We are excited to announce that the upcoming releases of Splunk Enterprise 10.2.x and Splunk Cloud Platform ...