- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

How to display a chart with raw data
e.g.
mysearch | table MyCount | timechart MyCount
or
mysearch | table MyCount | chart MyCount by _time
I don't want to calculate avg/count etc... just want to create a chart with whatever data I have
Thanks
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

You can try values(MyCount), e.g.
mysearch | table MyCount, _time | chart values(MyCount) by _time
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If you're going to use timechart
, you simply NEED to provide it with a statistical function. The reason for this is that timechart
operates on timespans in which it puts events. In order to guarantee it calculates just ONE unique value per timespan, it needs a way of calculating it - a function. If you don't define the timespan yourself it will be set dynamically depending on what timerange the whole search spans, but let's take an example where the timespan is 1 minute and that somewhere in your log you have 3 events occurring within 1 minute. timechart
then needs to know how to give you ONE value for "MyCount", even though there are 3 values of each. You can tell Splunk to just give you an average from the 3 events using the stats function avg:
mysearch | timechart avg(MyCount)
Or, if you only want the values from the first of the events within the time period, use first instead of avg. Want the sum? Use sum. And so on. More information on statistical functions is available here: http://www.splunk.com/base/Documentation/latest/SearchReference/Stats
There's also a second way to do this, which is to produce a table containing timestamps and values yourself and then feed them into the chart.
mysearch | table _time MyCount
This is an easy approach should give you what you want. The possible caveat is that if you have lots of values for MyCount returned from your search, you'll get more datapoints than what you can feed a chart with.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

You can try values(MyCount), e.g.
mysearch | table MyCount, _time | chart values(MyCount) by _time
