Splunk Search

Plot unique value in Timechart

rponcel
New Member

Hello team.

I need to plot only one value in my timechart.
I am using the next search string:

search...|timechart span=1d sum(GB) as sgb by index | addtotals

The values that I'm obtaining are in table mode like this:

_time index1 index2 index3 index4 Total

Each column has one value for each time and each index. When I select mode graph all the values are graphed.

I need create one graph for only one value (for example index1 versus time)

Thanks and regards.

0 Karma

lguinn2
Legend

The best way would be to specify the index in your search

yoursearchhere index=index1
| timechart span=1d sum(GB) as sgb

There is no way AFAIK to have the table view show all the indexes and yet have the chart show only one index.

0 Karma
Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...