Splunk Search

How to create a line chart with one line per value of a field?

Engager

Given the following snippets of log statements:

src=feed value=5
src=calc value=37
src=feed value=20
src=calc value=50
src=calc value=55
src=feed value=12

I want to create a line chart with one line showing the values when src=feed, and the other line showing the values when src=calc, but I'm not sure how to tell chart "chart these values if src=feed on this line"

I'm sure it's an extremely simple solution but being new to Splunk, it's not jumping out at me.

0 Karma
1 Solution

Splunk Employee
Splunk Employee

If you are plotting these two lines over time, you could use a timechart.

... | timechart values(value) by src

View solution in original post

0 Karma

Splunk Employee
Splunk Employee

If you are plotting these two lines over time, you could use a timechart.

... | timechart values(value) by src

View solution in original post

0 Karma