Splunk Search

How to achieve timeline visualization of event field over time?

James1
New Member

Hello,

I am trying to use the custom splunk visualisation

I have formatted my search as the following:

 

index=my_index my_search
| timechart span=30s sum(qty) as "Qty"

 

However,  when trying to apply the timeline visualization, each qty is displayed on it's own row instead of a single row with each 30s sum shown. 

Each one of the blue circles represents a qty.

Bad example of what is currently happeningBad example of what is currently happening

Below is what I am trying to achieve, each 30s bin shows a blue event circle and when mouseover it shows the sum of qty in that bin.

Good exampleGood example

Below is the format of my data

_time qty
2023-03-23 09:46:00 80
2023-03-23 09:46:30 85
2023-03-23 09:47:00 180
2023-03-23 09:47:30 276
2023-03-23 09:48:00 120
2023-03-23 09:48:30 390
2023-03-23 09:49:00 411
2023-03-23 09:49:30 125
2023-03-23 09:50:00 173
2023-03-23 09:50:30 40
2023-03-23 09:51:00 314

 

 

Thank you for any help.

Ultimately I want to see different fields on each row, this one will be qty, the next will be rating etc

Labels (3)
Tags (2)
0 Karma

tscroggins
Influencer

Hi,

It's not quite an intended timeline use case, but you can obtain the desired result by adding a resource field with value "Qty" and a dummy/null color field:

| tstats count as qty where index=_internal earliest=-1h@h latest=@h by _time span=30s 
| eval qty=if(qty%2==0, null(), qty)
| search qty=*
```end mock data```
| eval ```resource/row``` resource="Qty"
```include a dummy color field to render circles```
| table _time resource color qty

tscroggins_0-1680877288345.png

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...