Dashboards & Visualizations

How to control which series are charted by timechart?

alan_watt
Explorer

I'm trying to produce a graph of DHCP utilization. Input is a series of records inserted hourly with the critical fields "USED" (utilization percentage) and "NETWORK" (the CIDR for the network involved). I want to produce a graph of several day's data, but I only want to graph the most highly utilized networks (the ones likely to run out). Given that timechart only graphs 10 series, everything I try seems to be excliding several highly utilized networks in favor of less utilized ones.

(1) Is there any way to get timechart to graph more than 10 series? (2) My command is:

"%Infoblox-DHCP-Utilization" SIZE>10 USED>=50 | sort -date_day -date_hour -USED | timechart span="1h" values(USED) by NETWORK useother="false"

I was sort of guessing that timechart would work on the first 10 unique values it sees, hence the sort, which was an attempt to pick the most highly utilized networks from the most recent sample.

Tags (1)
0 Karma

gkanapathy
Splunk Employee
Splunk Employee

timechart can graph more series:

 ... | timechart limit=0 span=1h values(USED) by NETWORK

There's not much point in the sort, since timechart will sort by time first, and the columns will be sorted lexically.

Get Updates on the Splunk Community!

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...

Announcing the Migration of the Splunk Add-on for Microsoft Azure Inputs to ...

Announcing the Migration of the Splunk Add-on for Microsoft Azure Inputs to Officially Supported Splunk ...