Splunk Search

How to create a graph using distinct values?

carlsonbJTEKT
Engager

I want to create a graph that shows values over time, but I cannot figure out how to graph distinct values. Right now, I can only graph sum or median or average. How do you graph distinct values on a graph?

0 Karma

aweitzman
Motivator

I don't recommend this, since Splunk isn't really meant for this, but you can fake it if you reduce the time span to something where you can guarantee that you'll only get one event per span, and then graph that. So if your events are at least 3 seconds apart, you can do:

... | timechart span=3s values(MyField)

The "Line" chart will show what you want when formatted appropriately.

There are major problems with this, though, due to limits on items that can be graphed, as well as total number of rows in your time chart. You'd be better off in the long run trying to find another useful way to visualize your data.

0 Karma

woodcock
Esteemed Legend

Like this:

... | timechart span=1h dc(fieldname)
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...