Dashboards & Visualizations

graph or report based on value?

tinhuty
Engager

new to splunk, sorry if this is trivial.

by default the timeline graph are draw based on number of occurrence. I want something different.

say my log entry are like this:

Timestamp=2011/11/30 15:31:32.424, Timespent=0.4063
Timestamp=2011/11/30 15:24:16.653, Timespent=1.0156
Timestamp=2011/11/30 15:17:01.522, Timespent=0.4219
Timestamp=2011/11/30 15:09:28.907, Timespent=0.1250
Timestamp=2011/11/30 15:02:09.526, Timespent=0.1406
Timestamp=2011/11/30 14:55:10.615, Timespent=0.6875

1). is it possible to create report/graph using Timestamp field as X-axis and Timespent field as Y-axis?
2). how to create report that shows number of records(or percentage) that Timespent values are between 0-0.5 and 0.5-1.0 etc?

Thanks.

Tags (1)
0 Karma

Ayn
Legend

Sure. Use timechart!

First, some explanation on how timechart behaves: timechart needs some kind of statistical function that returns a unique value for the timespan it's operating on. If you don't define the timespan yourself it will be set dynamically depending on what timerange the whole search spans, but let's take an example where the timespan is 1 minute and that somewhere in your log you have 3 of these events occurring within 1 minute. Splunk needs to know how to give you ONE value for "Value", even though there are 3 values of each. You can tell Splunk to just give you an average from the 3 events using the stats function avg:

... | timechart span=1m avg(Timespent) as Timespent

Or, if you only want the values from the first of the events within the time period, use first instead of avg. Want the sum? Use sum. And so on. More information on statistical functions is available here: http://www.splunk.com/base/Documentation/latest/SearchReference/Stats

There's also a second way to do this, which is to produce a table containing timestamps and values yourself and then feed them into the chart.

... | table _time Timespent

As for the second question, you can achieve this by using bucket to divide Timespend into the intervals you want. Like this:

... | bucket Timespent span=0.5 | stats count by Timespent
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Cisco Data Fabric from Architecture to Investigation, Better SOC Visibility, and More ...

Splunk Lantern is Splunk’s customer success center that provides practical guidance from Splunk experts on key ...

The Trust Gap: Why a Data Foundation is Fundamental to an Agentic Enterprise

The Trust Gap: Why a data foundation is fundamental to an  Agentic Enterprise.   Agentic AI is transforming ...

Data Management Digest – September 2026

    Welcome to the September 2026 edition of Data Management Digest! September brought a fresh wave of ...