Splunk Search

How to display a chart with raw data?

jangid
Builder

How to display a chart with raw data

e.g.

mysearch | table MyCount | timechart MyCount
or
mysearch | table MyCount | chart MyCount by _time

I don't want to calculate avg/count etc... just want to create a chart with whatever data I have

Thanks

Tags (1)
1 Solution

twkan
Splunk Employee
Splunk Employee

You can try values(MyCount), e.g.

mysearch | table MyCount, _time | chart values(MyCount) by _time

View solution in original post

Ayn
Legend

If you're going to use timechart, you simply NEED to provide it with a statistical function. The reason for this is that timechart operates on timespans in which it puts events. In order to guarantee it calculates just ONE unique value per timespan, it needs a way of calculating it - a function. If you don't define the timespan yourself it will be set dynamically depending on what timerange the whole search spans, but let's take an example where the timespan is 1 minute and that somewhere in your log you have 3 events occurring within 1 minute. timechart then needs to know how to give you ONE value for "MyCount", even though there are 3 values of each. You can tell Splunk to just give you an average from the 3 events using the stats function avg:

mysearch | timechart avg(MyCount)

Or, if you only want the values from the first of the events within the time period, use first instead of avg. Want the sum? Use sum. And so on. More information on statistical functions is available here: http://www.splunk.com/base/Documentation/latest/SearchReference/Stats

There's also a second way to do this, which is to produce a table containing timestamps and values yourself and then feed them into the chart.

mysearch | table _time MyCount

This is an easy approach should give you what you want. The possible caveat is that if you have lots of values for MyCount returned from your search, you'll get more datapoints than what you can feed a chart with.

twkan
Splunk Employee
Splunk Employee

You can try values(MyCount), e.g.

mysearch | table MyCount, _time | chart values(MyCount) by _time

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

How Splunk AI Assistant Is Transforming Investigations: Insights from .conf26

At .conf26 in Denver, I spent much of my time in conversation with Splunk customers about Splunk AI Assistant. ...

Make Your Machine Data AI-Ready in Splunk

Every team is getting ready for AI agents.   Thursday, November 12, 2026  |  11AM  PST / 2PM EST   ...

Splunk Asynchronous Forwarding Explained

Splunk asynchronous forwarding is often misunderstood as simply setting autoLBVolume. That is not quite right. ...