Splunk Search

How to create a line chart so each data point shows three field values?

byu168168
Path Finder

I generated a line chart and am plotting on two fields: Time and ID, however, I want to see more than just these two fields. Is there a way to generate a chart so that each point on the line chart shows three field values: Time, ID, and Name?

0 Karma
1 Solution

jimodonald
Contributor

Line charts are designed for plotting two values on a axis. If it makes sense, you can concatenate the ID and Name into one field and plot that over time.

<your search> | eval NameID=Name+":"+ID | timechart values(NameID)

View solution in original post

0 Karma

jimodonald
Contributor

Line charts are designed for plotting two values on a axis. If it makes sense, you can concatenate the ID and Name into one field and plot that over time.

<your search> | eval NameID=Name+":"+ID | timechart values(NameID)
0 Karma

byu168168
Path Finder

Concatenation makes it look a little long and messy but should work fine. Thanks!

0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  &#x1f680; Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...