Splunk Search

Need chart for two values

edrad80
New Member

Hi

I have a basic XML file returning, Date-time value and a value in seconds see example("GmtDateTime":"2013-08-14 01:15:26","TotalSeconds":15.593). There is one value every 30 minutes. I need to have a column chart showing x - date-time and Y - TotalSeconds.

I have tried a lot of different options today but can never get it showing correctly.
Just need a pointer in the correct direction

Tags (2)
0 Karma

edrad80
New Member

It almost works, the GmtDateTime is correct but it shows the average TotalSeconds for all instances instead of the correct total

0 Karma

linu1988
Champion

Provided you are having the fields correctly extracted, you can have |Timechart avg(TotalSeconds) OR Chart avg(TotalSeconds) by GmtDateTime.

Just a table GmtDateTime,TotalSeconds. where your primary axis should be GmtDateTime and TotalSeconds can be secondary axis in module for dashboard

|Timechart span=30m  avg(TotalSeconds)

I have updated the answer, hope it works.

0 Karma
Get Updates on the Splunk Community!

Splunk MCP & Agentic AI: Machine Data Without Limits

  Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization ...

Finding Based Detections General Availability

Overview  We’ve come a long way, folks, but here in Enterprise Security 8.4 I’m happy to announce Finding ...

Get Your Hands Dirty (and Your Shoes Comfy): The Splunk Experience

Hands-On Learning and Technical Seminars  Sometimes, you just need to see the code. For those looking for a ...