Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Line Chart single value over time
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have a log containing memory usage over a period of time. How can I plot a line graph where the x-axis is the time, and the y-axis is the amount of memory used at that time.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If you want to grab each data point, just using table with the fields _time and your field containing the memory info will do. Let's say the field is called memory_used:
... | table _time memory_used
After that, choose the chart view and apply the appropriate settings.
If you have loads of data points there is a risk of overwhelming the chart module with more points than it can handle. In that case, use timechart and some kind of statistical function for representing values in a certain time interval, like first, max or avg. You need to supply some kind of statistical function because timechart divides the events into discrete sets of time intervals, and it needs to know how to handle if there is more than 1 event in an interval.
... | timechart avg(memory_used)
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If you want to grab each data point, just using table with the fields _time and your field containing the memory info will do. Let's say the field is called memory_used:
... | table _time memory_used
After that, choose the chart view and apply the appropriate settings.
If you have loads of data points there is a risk of overwhelming the chart module with more points than it can handle. In that case, use timechart and some kind of statistical function for representing values in a certain time interval, like first, max or avg. You need to supply some kind of statistical function because timechart divides the events into discrete sets of time intervals, and it needs to know how to handle if there is more than 1 event in an interval.
... | timechart avg(memory_used)
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
After tabulating the data, what settings do you use for chart? I have the table needed to chart by two different fields, but how do I chart Field A by Field B?
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas
What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)
Automating Threat Operations and Threat Hunting with Recorded Future
