Splunk Search

How to achieve timeline visualization of event field over time?

James1
New Member

Hello,

I am trying to use the custom splunk visualisation

I have formatted my search as the following:

 

index=my_index my_search
| timechart span=30s sum(qty) as "Qty"

 

However,  when trying to apply the timeline visualization, each qty is displayed on it's own row instead of a single row with each 30s sum shown. 

Each one of the blue circles represents a qty.

Bad example of what is currently happeningBad example of what is currently happening

Below is what I am trying to achieve, each 30s bin shows a blue event circle and when mouseover it shows the sum of qty in that bin.

Good exampleGood example

Below is the format of my data

_time qty
2023-03-23 09:46:00 80
2023-03-23 09:46:30 85
2023-03-23 09:47:00 180
2023-03-23 09:47:30 276
2023-03-23 09:48:00 120
2023-03-23 09:48:30 390
2023-03-23 09:49:00 411
2023-03-23 09:49:30 125
2023-03-23 09:50:00 173
2023-03-23 09:50:30 40
2023-03-23 09:51:00 314

 

 

Thank you for any help.

Ultimately I want to see different fields on each row, this one will be qty, the next will be rating etc

Labels (3)
Tags (2)
0 Karma

tscroggins
Influencer

Hi,

It's not quite an intended timeline use case, but you can obtain the desired result by adding a resource field with value "Qty" and a dummy/null color field:

| tstats count as qty where index=_internal earliest=-1h@h latest=@h by _time span=30s 
| eval qty=if(qty%2==0, null(), qty)
| search qty=*
```end mock data```
| eval ```resource/row``` resource="Qty"
```include a dummy color field to render circles```
| table _time resource color qty

tscroggins_0-1680877288345.png

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...