Splunk Search

How to display a chart with raw data?

jangid
Builder

How to display a chart with raw data

e.g.

mysearch | table MyCount | timechart MyCount
or
mysearch | table MyCount | chart MyCount by _time

I don't want to calculate avg/count etc... just want to create a chart with whatever data I have

Thanks

Tags (1)
1 Solution

twkan
Splunk Employee
Splunk Employee

You can try values(MyCount), e.g.

mysearch | table MyCount, _time | chart values(MyCount) by _time

View solution in original post

Ayn
Legend

If you're going to use timechart, you simply NEED to provide it with a statistical function. The reason for this is that timechart operates on timespans in which it puts events. In order to guarantee it calculates just ONE unique value per timespan, it needs a way of calculating it - a function. If you don't define the timespan yourself it will be set dynamically depending on what timerange the whole search spans, but let's take an example where the timespan is 1 minute and that somewhere in your log you have 3 events occurring within 1 minute. timechart then needs to know how to give you ONE value for "MyCount", even though there are 3 values of each. You can tell Splunk to just give you an average from the 3 events using the stats function avg:

mysearch | timechart avg(MyCount)

Or, if you only want the values from the first of the events within the time period, use first instead of avg. Want the sum? Use sum. And so on. More information on statistical functions is available here: http://www.splunk.com/base/Documentation/latest/SearchReference/Stats

There's also a second way to do this, which is to produce a table containing timestamps and values yourself and then feed them into the chart.

mysearch | table _time MyCount

This is an easy approach should give you what you want. The possible caveat is that if you have lots of values for MyCount returned from your search, you'll get more datapoints than what you can feed a chart with.

twkan
Splunk Employee
Splunk Employee

You can try values(MyCount), e.g.

mysearch | table MyCount, _time | chart values(MyCount) by _time

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...