Help with simple timechart query

[john_byun]

I have a list of events that have a specific value associated with each event. I want to create a line graph of those values. How do I do this?

The elapsed time between each event is not consistent, so I want each event to be logged as a data point on my graph to be able to see the trend over time.

[MuS]

Hi john.byun,

timechart will do aggregation on the events, if you don't want aggregation use chart or stats like this:

fieldvalue | chart values(fieldvalue) AS fieldvalues over _time
fieldvalue | stats values(fieldvalue) AS fieldvalues by _time

hope this helps ...

cheers, MuS

[MuS]

Please mark this as answered, if it worked for you - thx

[john_byun]

Perfect! Thank you very much.

[john_byun]

Here is what my data looks like below. I want to create a line chart with time on the x-axis and the fieldvalue on the y-axis.

Time Field Value
12:15 90
12:25 85
1:00 70
1:30 65
2:30 95
4:00 90

[john_byun]

Sorry,

fieldvalue | timechart avg(fieldvalue)

[grijhwani]

I don't think that is a complete search command.

[john_byun]

My current search is simply "timechart avg(fieldvalue)", but this does not give me the results that I want.

1. I do not want an average of the values.
2. I want each event to be a datapoint rather than giving me a single datapoint every 30 minutes.

[grijhwani]

As I always say, show us an example of your search, don't describe it.