Simple(?) realtime chart example

[chadroberts]

I'm trying to figure out how real-time charts are built and so far I've had zero success. Even doing something like creating a line chart with 'host=* | stats count' to show event counts over time isn't working. Is this something that can be done with simple XML or do I have to switch to advanced xml?

[Ron_Naken · Accepted solution]

Try your search a little different. Select in the time picker -- the green button to the right of your search bar -- that you want one of the real-time ranges. Then do your search like this:

host=* | chart count

Then click the "Build Report" button on the right by the time picker, once you have some data showing up. An easier method is to go into "Advanced Charting & Reporting" on the View menu to run your chart/timechart searches.

You might find the following tutorial of value. It will walk you through how to build charts and dashboards:
http://www.splunk.com/base/Documentation/4.2.1/User/WelcometotheSplunkTutorial

Cheers

[Ron_Naken]

You could simplify the syntax for that search, using timechart: host=* | timechart by sourcetype. When no data is coming in, the chart should still update, as long as you have a real-time range selected. The "null values" combo box has a selection to treat null/missing data as 0 or to connect it to the next value.

[chadroberts]

Thanks, that definitely put me in the right direction. The only issue I seem to have now is that zero values don't factor into the charting. The search I'm playing with is:
host=*|chart count by _time,sourcetype
Which in my case shows me counts for linux_audit and WinEventLog::Security, however for periods where no data is coming in the chart doesn't update, and leaves the previous non-zero count until a new non-zero number shows up. Is there a way to avoid this behavior?