Splunk Search

Help with simple timechart query

john_byun
Path Finder

I have a list of events that have a specific value associated with each event. I want to create a line graph of those values. How do I do this?

The elapsed time between each event is not consistent, so I want each event to be logged as a data point on my graph to be able to see the trend over time.

Tags (1)
0 Karma

MuS
Legend

Hi john.byun,

timechart will do aggregation on the events, if you don't want aggregation use chart or stats like this:

fieldvalue | chart values(fieldvalue) AS fieldvalues over _time
fieldvalue | stats values(fieldvalue) AS fieldvalues by _time

hope this helps ...

cheers, MuS

MuS
Legend

Please mark this as answered, if it worked for you - thx

0 Karma

john_byun
Path Finder

Perfect! Thank you very much.

0 Karma

john_byun
Path Finder

Here is what my data looks like below. I want to create a line chart with time on the x-axis and the fieldvalue on the y-axis.

Time Field Value
12:15 90
12:25 85
1:00 70
1:30 65
2:30 95
4:00 90

0 Karma

john_byun
Path Finder

Sorry,

fieldvalue | timechart avg(fieldvalue)

0 Karma

grijhwani
Motivator

I don't think that is a complete search command.

0 Karma

john_byun
Path Finder

My current search is simply "timechart avg(fieldvalue)", but this does not give me the results that I want.

  1. I do not want an average of the values.
  2. I want each event to be a datapoint rather than giving me a single datapoint every 30 minutes.
0 Karma

grijhwani
Motivator

As I always say, show us an example of your search, don't describe it.

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...