Splunk Search

Plot unique value in Timechart

rponcel
New Member

Hello team.

I need to plot only one value in my timechart.
I am using the next search string:

search...|timechart span=1d sum(GB) as sgb by index | addtotals

The values that I'm obtaining are in table mode like this:

_time index1 index2 index3 index4 Total

Each column has one value for each time and each index. When I select mode graph all the values are graphed.

I need create one graph for only one value (for example index1 versus time)

Thanks and regards.

0 Karma

lguinn2
Legend

The best way would be to specify the index in your search

yoursearchhere index=index1
| timechart span=1d sum(GB) as sgb

There is no way AFAIK to have the table view show all the indexes and yet have the chart show only one index.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

From Data to Insight: Announcing the Winners of the Splunk Dashboard Contest

Hi Splunkers, First off, thank you to everyone who participated in our very first From Data to Insight: The ...

Splunk Developers: Construct Your Future at the .conf26 Builder Bar

Calling all Splunk architects, platform admins, and app developers: the site is open, and the blueprints are ...

Quick connection discovery mode for forwarders

When a Splunk forwarder loses connectivity to its indexers, it does not always reconnect immediately. In many ...