Splunk Search

How to make a timechart/graph from a search result?

anirban_nag
Explorer

I have some events with message field as Bar Hello.., Bar Hi..., Bar Foo... and so on. I do not know beforehand how many this type of message are there. It is purely dynamical. But this messages are generated one at a time and timestamp of events with this messages are different. Now I want to show the search results as timechart. Right now I have this

index=baz host=server1 message="Bar*" | table host message _time | sort by -_time
Tags (3)
0 Karma

dcharboneau_spl
Splunk Employee
Splunk Employee

You should just need the timechart command.

See Below:

index=baz host=server1 message="Bar*" |timechart count(message) by message usenull=f useother=f

anirban_nag
Explorer

It would be good if in the graph it is a single line with different color for different type of message.

0 Karma

dcharboneau_spl
Splunk Employee
Splunk Employee

Not sure how that would work. A single line for x number of message types won't work as a visualization. you could do a Stacked column Chart view instead of a line chart. Above should produce multiple lines each a different color and one line for each message type over time.

cmccormick
Explorer

Are you wanting to know how many of the messages you are receiving for a given timeframe?

0 Karma

anirban_nag
Explorer

No I don't want to know how many but I want to create a line chart based on the messages and their frequency. Though I think I got close to it index=baz host=server1 message="Bar*" | table host message _time | sort by -_time | timechart span=2m count by message usenull=f. Now it would be good if in the graph it is a single line with different color for different type of message.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...