Splunk Search

How to display a chart with values and also a timechart below that?

chadman
Path Finder

I'm trying to show a chart and need to show the actual values. At the same time I would like to display a linear timeline at the bottom of the chart. Using this search, my chart looks good.

sourcetype="log_sort" host=myhost*  | chart values(idle) by _time

This works, but it does not display anything in the timechart at the bottom. I tried another search like this:

| timechart values(idle) as "Idle Time"

this shows the timechart at the bottom, but is trying to average my values. Many times my line will drop to 0 and I need to show that on the chart. Currently the avg might prevent this from happening. Any ideas?

Tags (2)
0 Karma
1 Solution

woodcock
Esteemed Legend

I believe you are misunderstanding the values function and what you are really trying to do is something this:

 sourcetype="log_sort" host=myhost* | timechart span=5m avg(idle) as "Idle Time"

View solution in original post

0 Karma

woodcock
Esteemed Legend

I believe you are misunderstanding the values function and what you are really trying to do is something this:

 sourcetype="log_sort" host=myhost* | timechart span=5m avg(idle) as "Idle Time"
0 Karma

chadman
Path Finder

Got it. When I used the values it just looked how I wanted it to. I think setting the span to a lower time would also help. My data is normally updated every min. My goal is to have the chart really indicate that it's 0 when that occurs and not an average. I think the span was being auto-scaled and that might be why my charts did not look right when I looked at data over a longer period of time.

0 Karma

woodcock
Esteemed Legend

OK, then something more like this:

sourcetype="log_sort" host=myhost* | timechart span=1m max(idle) as "Idle Time"

This way the 0 values of Idle Time indicate the gaps.

0 Karma

chadman
Path Finder

That works great!

0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...