Dashboards & Visualizations

How to plot a graph based on a field's value against time?

siddhantkumar08
Observer

I have a field whose value ranges from 0 to 20. I want to plot the graph to find the range of values being hit for the field every day.

I tried using timechart but instead of it giving me ranges per day it starts building out graphs per value, like value 1 occurred on day1 ,day 2, day 4. I need it to tell me what all values occurred on a particular day rather than what days have those values.

 

index=a $search string$
| eval bytes=bytes/1000000
| timechart count by bytes

 

Hope I could explain what I am trying here..

Labels (2)
Tags (2)
0 Karma

siddhantkumar08
Observer

Is there a way to cover the values in between  min and max as well?

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

Couldn't understand what is your use case exactly. Please explain.

0 Karma

siddhantkumar08
Observer

I would need to know the value of bytes each day. so day 1 it can be 0,2,3,4; day 2 it is 3,4,5; 

similiarly within a day, 1pm-2pm: it was 4,2,5 and 2pm-3pm  it was 0,3,2

Something like the above..

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

Try this:

<your search>
| timechart span=1d min(bytes) as min_value, max(bytes) as max_value

- I'm assuming your field name is bytes but you can change it.

- This should give you two lines if you use a line chart as visualization. For daily min_value and max_value.

0 Karma
Get Updates on the Splunk Community!

Splunk App for Anomaly Detection End of Life Announcement

Q: What is happening to the Splunk App for Anomaly Detection?A: Splunk is officially announcing the ...

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...