Splunk Search

How do you create multiple timechart graphs with the same time scale?

peterson_wwt
New Member

I have many different but simultaneous metrics that I am graphing over time. The y axis for each have different ranges. (0 to a million or 30% to 70% or whatever) but the time (x axis) is concurrent for all.

I want to put these charts in a dashboard, vertically stacked, and have the timescales for each match up exactly.

Some things I have tried that don't quite work:

  • Multi-series mode: This forces me to choose one chart format for each, but I need some to be lines, some to be bar charts, and some to be bubble charts.
  • Chart overlay: This is fine for two series, but I have many.
  • Creating one big table and then just field - away the ones I don't care about about for each panel. This is tedious and I have not gotten consistent results. Also, the search for the report becomes complex as I have multiple indexes, sources and sourcetypes for each time series. Ideally each search could run independent but share a single timescale for the entire dashboard.

I have seen tools like Grafana do this easily. I don't need the shared crosshair like Grafana does, but I do need a shared timescale.

Surely there is a way to do this with Splunk and I am just ignorant.

Please help!

Thanks

0 Karma

skoelpin
SplunkTrust
SplunkTrust

You can set the static y axis values by going to Format and selecting the static ranges

0 Karma

peterson_wwt
New Member

It is the x axis (time) that I need to be manually set actually.

y axis should conform to whatever the range of the data is.

0 Karma

skoelpin
SplunkTrust
SplunkTrust

Are you referring to splitting time into finer granularities? If so, you use span parameter on your timechart command

0 Karma

peterson_wwt
New Member

that is part of it, but not entirely the thing. I need the left and right bounds of the time scale to be identical for multiple charts. In doing that I also expect that the bucket size (which you could set with span) to be identical, but don't want to set span explicitly because the timescale will vary widely from dashboard to dashboard.

After doing some reading it seems I need to set <earliest> and <latest> in the xml for each chart. I am trying to do that now based off a report but can't figure out how to set those tokens yet.

0 Karma

PavelNed
Explorer

@peterson_wwt  found answer to this?

Facing exactly the same problem.

0 Karma
Get Updates on the Splunk Community!

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...