Display all values (including duplicate values) in timechart graph

[AKG1_old1]

Hello,

In my data, there could be multiple values(duration) for Scriptname. I am using Time Chart to display data and it should include all values including duplicates.

All Data

Time Chart

My Query:

eventtype=mlc_live host=TALANX_PostGoLive sourcetype=tool_lifecycle |  rex field="ScriptName" "^\S+_(?<ScriptName>[^\.]+)\.\S+" |  table _time Duration GROUPBY ScriptName UniqueIdentifier | dedup UniqueIdentifier | timechart max(Duration) BY ScriptName

Currently, I am using max function which include only one value. How can I display all events (including duplicates) in time chart graph.

[cmerriman]

try this instead of timechart, but i'm not sure if the visualization is going to like it or not.

|eval {ScriptName}=Duration
|fields - ScriptName Duration UniqueIdentifier

[AKG1_old1]

trick worked for fetching all data but unfortunately not working visually. 😞

[elliotproebstel]

I think you're looking for list() or values() instead of max(). Check out this documentation to help you decide which of those will work better for your use case:
http://docs.splunk.com/Documentation/Splunk/7.0.0/SearchReference/Multivaluefunctions

[AKG1_old1]

Thanks for reply. I tried both list() and values() but these function will include all duplicate values in same row which wont be displayed on Graph.