I want to make a presentation in a dashboard where I can see a line per service with the duration of each call of that service.
I have made a table in splunk and would create a linechart wiht multiple lines (per service a line) with duration in y-as en time in x-as. How can i do that? Or is there another way to get that done?
my search:
index=test sourcetype=test-performance duration>0 | convert timeformat="%Y-%m-%dT%H:%M:%S%:z" ctime(_time) AS date | table date, metric, duration | sort by date
some events from the table.
date metric duration
2021-08-25T08:55:28+02:00 service1 93
2021-08-25T08:55:28+02:00 service1 4
2021-08-25T08:55:28+02:00 service3 3
2021-08-25T08:55:28+02:00 service4 1
2021-08-25T08:55:23+02:00 service5 84
2021-08-25T08:55:20+02:00 service5 88
2021-08-25T08:50:55+02:00 service1 91
2021-08-25T08:50:55+02:00 service1 18
2021-08-25T08:50:55+02:00 service3 14
2021-08-25T08:50:55+02:00 service6 2
2021-08-25T08:50:55+02:00 service7 4
2021-08-25T08:50:55+02:00 service4 5
2021-08-25T08:50:54+02:00 service8 46
2021-08-25T08:50:54+02:00 service9 43
2021-08-25T08:49:58+02:00 service1 88
2021-08-25T08:49:58+02:00 service1 17
2021-08-25T08:49:58+02:00 service3 16
2021-08-25T08:49:58+02:00 service10 10
2021-08-25T08:49:58+02:00 service11 10
2021-08-25T08:49:58+02:00 service6 2
Try
| xyseries _time metric duration
Found it. With "chart first(duration) OVER date BY metric" it has succeeded to create my dashboard