Splunk Search

How to display a chart with values and also a timechart below that?

chadman
Path Finder

I'm trying to show a chart and need to show the actual values. At the same time I would like to display a linear timeline at the bottom of the chart. Using this search, my chart looks good.

sourcetype="log_sort" host=myhost*  | chart values(idle) by _time

This works, but it does not display anything in the timechart at the bottom. I tried another search like this:

| timechart values(idle) as "Idle Time"

this shows the timechart at the bottom, but is trying to average my values. Many times my line will drop to 0 and I need to show that on the chart. Currently the avg might prevent this from happening. Any ideas?

Tags (2)
0 Karma
1 Solution

woodcock
Esteemed Legend

I believe you are misunderstanding the values function and what you are really trying to do is something this:

 sourcetype="log_sort" host=myhost* | timechart span=5m avg(idle) as "Idle Time"

View solution in original post

0 Karma

woodcock
Esteemed Legend

I believe you are misunderstanding the values function and what you are really trying to do is something this:

 sourcetype="log_sort" host=myhost* | timechart span=5m avg(idle) as "Idle Time"
0 Karma

chadman
Path Finder

Got it. When I used the values it just looked how I wanted it to. I think setting the span to a lower time would also help. My data is normally updated every min. My goal is to have the chart really indicate that it's 0 when that occurs and not an average. I think the span was being auto-scaled and that might be why my charts did not look right when I looked at data over a longer period of time.

0 Karma

woodcock
Esteemed Legend

OK, then something more like this:

sourcetype="log_sort" host=myhost* | timechart span=1m max(idle) as "Idle Time"

This way the 0 values of Idle Time indicate the gaps.

0 Karma

chadman
Path Finder

That works great!

0 Karma
Get Updates on the Splunk Community!

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

What's New in Splunk Observability Cloud and Splunk AppDynamics - May 2025

This month, we’re delivering several new innovations in Splunk Observability Cloud and Splunk AppDynamics ...

Getting Started with Splunk Artificial Intelligence, Insights for Nonprofits, and ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...