Splunk Search

Display a timechart count as positive and negative values.

New Member

I've a standard time chart, counting up HTTP error codes. It's all fine, however I'd like to separate out the error-type codes. A good visual way would be to somehow alter them with a negative modifier.

For example I have the HTTP OK code as coming up as a total of 200 events on Monday, while I have 10 404 errors. I'd like someway to alter the 10 to -10 so that when it's graphed it's easy to identify the errors - as they all lie below the X axis. I don't need an exact answer, just a nudge in the right direction.

0 Karma


Can you try this:

your query to get you the stats of status and count
| eval myCount=if(status!=200, -count, count)
| timechart values(myCount) by status
0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...