Plotting % on yaxis

[vikramnpanchal]

Need to plot line chart below table "Max Busy Rate by processor" and want to show % values on yaxis and time on x-axis.

1 Date/Time Max Busy Rate Processor
2 10/29/2012 11:00 12% CHA-1H-3
3 10/29/2012 11:00 1% CHA-1H-2
4 10/29/2012 11:00 17% CHA-1H-1
5 10/29/2012 11:00 9% CHA-1H-0
6 10/29/2012 11:00 27% CHA-1H-3
7 10/29/2012 11:00 3% CHA-1H-2
8 10/29/2012 11:00 15% CHA-1H-1
9 10/29/2012 11:00 14% CHA-1H-0
10 10/29/2012 11:00 15% CHA-1H-3

[lguinn2 · Accepted solution]

One of the tricks to charting is that Splunk requires one of the chart/timechart functions for the y-axis. In the example data above, you could use variety of different functions - I will use max

Second, you need to know the field names for your data. For this example, I will assume that Splunk has correctly identified the date/time of the event, and that you also have fields named busy and processor

yoursearchhere
| eval busy = tonumber(replace(busy,"%",""))
| timechart span=1h max(busy) by processor