Dashboards & Visualizations

How to plot a graph based on a field's value against time?

siddhantkumar08
Observer

I have a field whose value ranges from 0 to 20. I want to plot the graph to find the range of values being hit for the field every day.

I tried using timechart but instead of it giving me ranges per day it starts building out graphs per value, like value 1 occurred on day1 ,day 2, day 4. I need it to tell me what all values occurred on a particular day rather than what days have those values.

 

index=a $search string$
| eval bytes=bytes/1000000
| timechart count by bytes

 

Hope I could explain what I am trying here..

Labels (2)
Tags (2)
0 Karma

siddhantkumar08
Observer

Is there a way to cover the values in between  min and max as well?

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

Couldn't understand what is your use case exactly. Please explain.

0 Karma

siddhantkumar08
Observer

I would need to know the value of bytes each day. so day 1 it can be 0,2,3,4; day 2 it is 3,4,5; 

similiarly within a day, 1pm-2pm: it was 4,2,5 and 2pm-3pm  it was 0,3,2

Something like the above..

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

Try this:

<your search>
| timechart span=1d min(bytes) as min_value, max(bytes) as max_value

- I'm assuming your field name is bytes but you can change it.

- This should give you two lines if you use a line chart as visualization. For daily min_value and max_value.

0 Karma
Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...