How to create a timechart with actual values instead of some function of the actual values (such as sum, avg) etc?

[gb0143]

I have a splunk query of the following:

<searc> | timechart avg(cache_size) by host_instance

That will give me the average cache size per day. However I want to use the time metric for the log to visualize how much of each "host_instance" cache is being used at a certain time. Ideally I would l like to look at this chart and see how much cache was used by instance "a" (and all other instances) at a certain time.

[DalJeanis]

Adjust the timespan. 1h, 30m, 15m should be viable ...

  your search  | timechart span=1h avg(cache_size) by host_instance

[somesoni2]

Charts have limits on how many points they can show, that's why it advisable to use an aggregation command to reduce the number of points plotted (see this for limits: http://docs.splunk.com/Documentation/SplunkCloud/6.6.1/Viz/ChartDisplayissues#Searches_with_non-tran...). You may be able to avoid using aggregation command and using just simple table command to show all points. How many events you've with our base search ?

[cmerriman]

would values(cache_size) or list(cache_size) be what you are looking for? or perhaps |bucket _time span=1d |table _time host_instance cache_size but bucket by 1d, 1h, etc., depending on what you need

otherwise, if you could more clearly define the expected output, that would be very helpful

[Richfez]

Also, if you could maybe mock up what that shows that isn't what you need, and what you'd like instead?