Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Multiple fields in one chart
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
I struggling to create chart, which will be with multiple field values (max,avg and min pauses) + need to see months (January, February, March etc.) in X-Axis
What I need to change here?
| eval fields=split(_raw," ")
| eval pauses=mvindex(fields,8)
| eventstats max(pauses) as Max_pause
| eventstats avg(pauses) as Avg_pause
| eventstats min(pauses) as Min_pause
| table Max_pause Avg_pause Min_pause
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
It would be helpful if you could post some sample data. Does your data have the _time field?
If you want a chart with time as the X-axis, then take a look at timechart.
Try something like this:
... | eval fields=split(_raw," ") | eval pauses=mvindex(fields,8) | timechart span=1mon max(pauses) as Max_pause avg(pauses) as Avg_pause min(pauses) as Min_pause
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
It would be helpful if you could post some sample data. Does your data have the _time field?
If you want a chart with time as the X-axis, then take a look at timechart.
Try something like this:
... | eval fields=split(_raw," ") | eval pauses=mvindex(fields,8) | timechart span=1mon max(pauses) as Max_pause avg(pauses) as Avg_pause min(pauses) as Min_pause
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
It worked without span=1mon, thanks!
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Unlocking Unified Insights: New Gigamon Federated Search App for Splunk
GA: New Data Management App in Splunk Platform
Announcing Modern Navigation: A New Era of Splunk User Experience
