How to make a linechart with a table and multiple lines

[sjansma]

I want to make a presentation in a dashboard where I can see a line per service with the duration of each call of that service. 

I have made a table in splunk and would create a linechart wiht multiple lines (per service a line) with duration in y-as en time in x-as. How can i do that? Or is there another way to get that done?

my search:

index=test sourcetype=test-performance duration>0 | convert timeformat="%Y-%m-%dT%H:%M:%S%:z" ctime(_time) AS date | table date, metric, duration | sort by date

some events from the table. 

date                                                     metric        duration
2021-08-25T08:55:28+02:00 service1    93
2021-08-25T08:55:28+02:00 service1    4
2021-08-25T08:55:28+02:00 service3    3
2021-08-25T08:55:28+02:00 service4    1
2021-08-25T08:55:23+02:00 service5    84
2021-08-25T08:55:20+02:00 service5    88
2021-08-25T08:50:55+02:00 service1    91
2021-08-25T08:50:55+02:00 service1   18
2021-08-25T08:50:55+02:00 service3   14
2021-08-25T08:50:55+02:00 service6   2
2021-08-25T08:50:55+02:00 service7   4
2021-08-25T08:50:55+02:00 service4   5
2021-08-25T08:50:54+02:00 service8   46
2021-08-25T08:50:54+02:00 service9   43
2021-08-25T08:49:58+02:00 service1   88
2021-08-25T08:49:58+02:00 service1   17
2021-08-25T08:49:58+02:00 service3   16
2021-08-25T08:49:58+02:00 service10 10
2021-08-25T08:49:58+02:00 service11 10
2021-08-25T08:49:58+02:00 service6    2

[ITWhisperer]

Try

| xyseries _time metric duration

[sjansma]

Found it. With "chart first(duration) OVER date BY metric" it has succeeded to create my dashboard