Splunk Search

Build a chart of multiple data series


Hi to everyone,

I am designing an application where my users will potentially need to be able to generate a chart with multiple data series. (depending on their own selection and various options available)

I searched in different posts and i followed this doc with success:

This works good, but still i have a small issue with the chart being created in the dashboard, the time period is technically correct but not being shown as would generates the timechart command. (each date section is being shown so too much data with more than a few hours)

A correct chart generated with timechart:
alt text

A chart generating with the stat command with multiple series:
alt text

My command is the following:

index="rls_index" sourcetype="rls_source" $hostname$ $monitor$ $monitor_label$
bucket _time span=1h | stats max(value) As ValMax, min(value) As ValMin by _time,monitor_label |
eval s1="max min" | makemv s1 | mvexpand s1 | eval yval=case(s1=="max",ValMax,s1=="min",ValMin) | eval series=monitor_label+":"+s1 | convert ctime(_time) as time | xyseries time,series,yval

I needed to add the section "convert ctime(_time) as time" to get a shorter and more readable time format.

Does anyone knows how to generate a chart with the time period being correctly shown like with timechart ?

I had to use the bucket command to limit the amount of data generated, i also would like to put a timerange condition like the timechart command automatically does ? (something like if more than 1 day then bucket 1 hour and so on)

Thank you in advance for any help you could provide.

Long live to Splunk ^^

Tags (3)


Use _time in xyseries and add ... | makecontinuous _time to the end. You don't need to convert _time beforehand.

The charting stuff makes the x-axis labels 'pretty' if it contains regularly intervaled epoch values


Thanks Guilhem. Accepting the answer is the usual way to award rep (you dont have to spend your own)

0 Karma



Thank you very much, you perfectly answered to my question!


0 Karma
Get Updates on the Splunk Community!

Platform Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestIntroducing Splunk Edge Processor, simplified data ...

Enterprise Security Content Updates (ESCU) - New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 3 releases of new content via the Enterprise ...

Thought Leaders are Validating Your Hard Work and Training Rigor

As a Splunk enthusiast and member of the Splunk Community, you are one of thousands who recognize the value of ...