Splunk Search

Build a chart of multiple data series


Hi to everyone,

I am designing an application where my users will potentially need to be able to generate a chart with multiple data series. (depending on their own selection and various options available)

I searched in different posts and i followed this doc with success:

This works good, but still i have a small issue with the chart being created in the dashboard, the time period is technically correct but not being shown as would generates the timechart command. (each date section is being shown so too much data with more than a few hours)

A correct chart generated with timechart:
alt text

A chart generating with the stat command with multiple series:
alt text

My command is the following:

index="rls_index" sourcetype="rls_source" $hostname$ $monitor$ $monitor_label$
bucket _time span=1h | stats max(value) As ValMax, min(value) As ValMin by _time,monitor_label |
eval s1="max min" | makemv s1 | mvexpand s1 | eval yval=case(s1=="max",ValMax,s1=="min",ValMin) | eval series=monitor_label+":"+s1 | convert ctime(_time) as time | xyseries time,series,yval

I needed to add the section "convert ctime(_time) as time" to get a shorter and more readable time format.

Does anyone knows how to generate a chart with the time period being correctly shown like with timechart ?

I had to use the bucket command to limit the amount of data generated, i also would like to put a timerange condition like the timechart command automatically does ? (something like if more than 1 day then bucket 1 hour and so on)

Thank you in advance for any help you could provide.

Long live to Splunk ^^

Tags (3)


Use _time in xyseries and add ... | makecontinuous _time to the end. You don't need to convert _time beforehand.

The charting stuff makes the x-axis labels 'pretty' if it contains regularly intervaled epoch values


Thanks Guilhem. Accepting the answer is the usual way to award rep (you dont have to spend your own)

0 Karma



Thank you very much, you perfectly answered to my question!


0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...