Splunk Search

How to display a chart with values and also a timechart below that?

chadman
Path Finder

I'm trying to show a chart and need to show the actual values. At the same time I would like to display a linear timeline at the bottom of the chart. Using this search, my chart looks good.

sourcetype="log_sort" host=myhost*  | chart values(idle) by _time

This works, but it does not display anything in the timechart at the bottom. I tried another search like this:

| timechart values(idle) as "Idle Time"

this shows the timechart at the bottom, but is trying to average my values. Many times my line will drop to 0 and I need to show that on the chart. Currently the avg might prevent this from happening. Any ideas?

Tags (2)
0 Karma
1 Solution

woodcock
Esteemed Legend

I believe you are misunderstanding the values function and what you are really trying to do is something this:

 sourcetype="log_sort" host=myhost* | timechart span=5m avg(idle) as "Idle Time"

View solution in original post

0 Karma

woodcock
Esteemed Legend

I believe you are misunderstanding the values function and what you are really trying to do is something this:

 sourcetype="log_sort" host=myhost* | timechart span=5m avg(idle) as "Idle Time"
0 Karma

chadman
Path Finder

Got it. When I used the values it just looked how I wanted it to. I think setting the span to a lower time would also help. My data is normally updated every min. My goal is to have the chart really indicate that it's 0 when that occurs and not an average. I think the span was being auto-scaled and that might be why my charts did not look right when I looked at data over a longer period of time.

0 Karma

woodcock
Esteemed Legend

OK, then something more like this:

sourcetype="log_sort" host=myhost* | timechart span=1m max(idle) as "Idle Time"

This way the 0 values of Idle Time indicate the gaps.

0 Karma

chadman
Path Finder

That works great!

0 Karma
Get Updates on the Splunk Community!

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...

From Alert to Resolution: How Splunk Observability Helps SREs Navigate Critical ...

It's 3:17 AM, and your phone buzzes with an urgent alert. Wire transfer processing times have spiked, and ...