Splunk Search
Highlighted

Bar + line in chart?

New Member

I have two types of events, where the important data looks like this:

[
  {
    "acknowledged": false,
    "time": 1588289278000,
  },
  {
    "acknowledged": {
      "time": 1588232449000,
      "username": "admin"
    },
    "time": 1588145193000,
  }
]

Per day, I want a bar chart of the count of the events that contains an acknowledge object. I also want to plot a line that contains the average acknowledgement time (acknowledged.time - time).

0 Karma
Highlighted

Re: Bar + line in chart?

SplunkTrust
SplunkTrust

write your query that calculates the average acknowledgement time and the count of events over time then when using the bar chart, click edit and use chart overlay. pick the desired field as overlay line over the bar

View solution in original post

0 Karma
Highlighted

Re: Bar + line in chart?

New Member

Thanks. Solved the problem

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.