Dashboards & Visualizations

How to plot a graph based on a field's value against time?

siddhantkumar08
Observer

I have a field whose value ranges from 0 to 20. I want to plot the graph to find the range of values being hit for the field every day.

I tried using timechart but instead of it giving me ranges per day it starts building out graphs per value, like value 1 occurred on day1 ,day 2, day 4. I need it to tell me what all values occurred on a particular day rather than what days have those values.

 

index=a $search string$
| eval bytes=bytes/1000000
| timechart count by bytes

 

Hope I could explain what I am trying here..

Labels (2)
Tags (2)
0 Karma

siddhantkumar08
Observer

Is there a way to cover the values in between  min and max as well?

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

Couldn't understand what is your use case exactly. Please explain.

0 Karma

siddhantkumar08
Observer

I would need to know the value of bytes each day. so day 1 it can be 0,2,3,4; day 2 it is 3,4,5; 

similiarly within a day, 1pm-2pm: it was 4,2,5 and 2pm-3pm  it was 0,3,2

Something like the above..

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

Try this:

<your search>
| timechart span=1d min(bytes) as min_value, max(bytes) as max_value

- I'm assuming your field name is bytes but you can change it.

- This should give you two lines if you use a line chart as visualization. For daily min_value and max_value.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Network to App: Observability Unlocked [May & June Series]

In today’s digital landscape, your environment is no longer confined to the data center. It spans complex ...

SPL2 Deep Dives, AppDynamics Integrations, SAML Made Simple and Much More on Splunk ...

Splunk Lantern is Splunk’s customer success center that provides practical guidance from Splunk experts on key ...

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...