How we can create a multi line chart to display the trend over a period of time.

[Real_captain]

Hi 
Can you please help me to create multi line chart with the below data. 

Data in the below format is fetched in SPlunk. I need to create a multi line chart with the same data as below: 

Data : 

On the X axis : Time 
Y axis : column1 

Count1, count2 and count3 should be the 3 lines in the multi line chart. 
Last command in the Splunk Query to fetch the data in the table form is below : 

| table column1  column2  Time Count1 Count2 Count3 

With this data can we create a multi linechart in SPlunk ? 

[Real_captain]

HI @ITWhisperer 

Can we have a line chart with 
d
X axis = _time 

Y axis = column1  

and value of count1 count2 count3 as 3 lines on the chart ?? 

[ITWhisperer]

No, the y-axis represents a numeric which in your example would be the values from count1, count2 and count3

[Real_captain]

@ITWhisperer  

OK , How we can create such a line chart with 

X axis as Time ( not _time) 
Y axis as count1 count2 count3 

[ITWhisperer]

| table Time count1 count2 count3

The first field (column) will be the x axis, the other columns will be the lines.

[Real_captain]

Hi @ITWhisperer 
It resolved my query. 
Time = Corresponds to hour of Time
count1 = Count of records of current week
count2 = Count of records of current week - 1  
count3 = Count of records of current week - 2 

I need to restrict the X axis with the hour of the current day (Today) only. But when i select the Global time range as today, count2 and count3 becomes blank. 

Is it possible to select the global time range as Last 30 days to fetch last 30 days data and view the X Axis with the hour of Time. 0-24 hour.  (1 day )

Current it shows 0-24 hour in X axis many times (every hour in last 30 days). 

Can you please help me with this request. 

[ITWhisperer]

You will need to clarify what it is you are trying to do - do you want an hourly count i.e. the x-axis is 0-23? If so, what has weekly counts got to do with it? What are count1, count2 and count3 in this respect? What does your source data look like and what do you want your results to look like?

[Real_captain]

Yes , I want to do the hourly count (0-23) in the X Axis. 

X Axis = Hour of the day ( stored in the field Time ). 

Y axis : 3 lines ( Count1 , count2 , count3) . 

Count 1 : Corresponds to the count of record of current week at a particular hour. 
Count 2 : Corresponds to the count of record of current week - 1  at a particular hour. 
Count 3 : Corresponds to the count of record of current week - 2  at a particular hour. 

Result should be like below: 

[ITWhisperer]

So, just to be clear, count1 is the sum of the hourly counts for the current week, e.g. hour 0 for count1 is the total of all the counts for 00:00 to 00:59 for all the days (so far) in the current week, hour 0 for count2 is the total of all the counts for 00:00 to 00:59 for all the days in the previous week, etc.?

[Real_captain]

HI 
hour 0 for count1 is the total of all the counts for 00:00 to 00:59 for the current day (Monday) in the current week. 
hour 0 for count2 is the total of all the counts for 00:00 to 00:59 for the current day (Monday) in the previous week
hour 0 for count3 is the total of all the counts for 00:00 to 00:59 for the current day (Monday) in the Current week -2 

So, in X Axis we have 0-24 hours for the current day and in the Y axis, we have 3 lines 
count1: Count of particular hour of the day in the current week   
count2 : Count of particular hour of the day in the previous week   
count3 : Count of particular hour of the day in the  current week 

Plan is to compare : when current day is Monday
the count of 8th hour of Monday with the last week Monday and with the last to last week Monday. 
the count of 9th hour of Monday with the last week Monday and with the last to last week Monday. 
the count of 10th hour of Monday with the last week Monday and with the last to last week Monday. 
and so on till 24th Hour 

We have fields like Current_day (example Monday , Tuesday etc) , Current_Week (example 41 or 40 etc) extracted in the query. 

[ITWhisperer]

| timechart sum(count) as total span=1h
| timewrap 1w
| where strftime(_time,"%a") = strftime(now(),"%a")
| eval hour=strftime(_time,"%H")
| fields - _time
| table hour *

[ITWhisperer]

Essentially, a line chart will be visualised from a table with the first column being the x-axis, normally a timestamp (_time), with the subsequent columns providing the values for the lines on the chart. Your table does not match these criteria so you would not be able to represent your table as a line chart (without removing or combining some of your data.