Splunk Search

How to create a timeline table?

faustf
Communicator

Hi,
we are logging api requests in Splunk.

I would like to create a sort of health check table where every column represents the status code of the last API call in previous 5 minutes. While each row is a different API.

Here an example of what the output should be

IMG_0259.jpeg

Any Idea how I could achieve that in Splunk?

Each row represents a different API ( request.url), while the status code is stored in response.status

Thank you

Labels (1)
Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

See if this helps.  It uses actual times rather than relative ones, but the format is there.

index=_internal status=* earliest=-30m 
``` Get the most recent status for each API every 5 minutes
| timechart span=5m latest(status) as status by API
``` Convert timestamp to time (HH:MM) ```
| eval _time=strftime(_time,"%H:%M") 
``` Flip the display so time is across the top and API down the side ```
| transpose 0 header_field=_time column_name="API" 
``` Fill in blank cells ```
| fillnull value="-"
---
If this reply helps you, Karma would be appreciated.

faustf
Communicator

Very good this is what I was looking for. Thank you.

Do you know how I can now color each cell depending on the status code?

Usually I use the following configuration in the dashboard

<format type="color" field="status">
  <colorPalette type="expression">case(value like "5%","#D6563C",value like "4%","#F2B827",value like "3%","#A2CC3E",value like "2%","#65A637",true(),null)</colorPalette>
</format>

 

but it is not working now (I suppose because of the transpose command).

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I suspect you are right, but you probably should post a separate question about that.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...