Dashboards & Visualizations
Highlighted

Simple(?) realtime chart example

Path Finder

I'm trying to figure out how real-time charts are built and so far I've had zero success. Even doing something like creating a line chart with 'host=* | stats count' to show event counts over time isn't working. Is this something that can be done with simple XML or do I have to switch to advanced xml?

Tags (2)
0 Karma
Highlighted

Re: Simple(?) realtime chart example

Splunk Employee
Splunk Employee

Try your search a little different. Select in the time picker -- the green button to the right of your search bar -- that you want one of the real-time ranges. Then do your search like this:

host=* | chart count

Then click the "Build Report" button on the right by the time picker, once you have some data showing up. An easier method is to go into "Advanced Charting & Reporting" on the View menu to run your chart/timechart searches.

You might find the following tutorial of value. It will walk you through how to build charts and dashboards:
http://www.splunk.com/base/Documentation/4.2.1/User/WelcometotheSplunkTutorial

Cheers

View solution in original post

Highlighted

Re: Simple(?) realtime chart example

Path Finder

Thanks, that definitely put me in the right direction. The only issue I seem to have now is that zero values don't factor into the charting. The search I'm playing with is:
host=*|chart count by time,sourcetype
Which in my case shows me counts for linux
audit and WinEventLog::Security, however for periods where no data is coming in the chart doesn't update, and leaves the previous non-zero count until a new non-zero number shows up. Is there a way to avoid this behavior?

0 Karma
Highlighted

Re: Simple(?) realtime chart example

Splunk Employee
Splunk Employee

You could simplify the syntax for that search, using timechart: host=* | timechart by sourcetype. When no data is coming in, the chart should still update, as long as you have a real-time range selected. The "null values" combo box has a selection to treat null/missing data as 0 or to connect it to the next value.