How to display a chart with values and also a timechart below that?

[chadman]

I'm trying to show a chart and need to show the actual values. At the same time I would like to display a linear timeline at the bottom of the chart. Using this search, my chart looks good.

sourcetype="log_sort" host=myhost*  | chart values(idle) by _time

This works, but it does not display anything in the timechart at the bottom. I tried another search like this:

| timechart values(idle) as "Idle Time"

this shows the timechart at the bottom, but is trying to average my values. Many times my line will drop to 0 and I need to show that on the chart. Currently the avg might prevent this from happening. Any ideas?

[woodcock · Accepted solution]

I believe you are misunderstanding the values function and what you are really trying to do is something this:

 sourcetype="log_sort" host=myhost* | timechart span=5m avg(idle) as "Idle Time"

[chadman]

Got it. When I used the values it just looked how I wanted it to. I think setting the span to a lower time would also help. My data is normally updated every min. My goal is to have the chart really indicate that it's 0 when that occurs and not an average. I think the span was being auto-scaled and that might be why my charts did not look right when I looked at data over a longer period of time.

[woodcock]

OK, then something more like this:

sourcetype="log_sort" host=myhost* | timechart span=1m max(idle) as "Idle Time"

This way the 0 values of Idle Time indicate the gaps.

[chadman]

That works great!