Splunk Search

Plot unique value in Timechart

rponcel
New Member

Hello team.

I need to plot only one value in my timechart.
I am using the next search string:

search...|timechart span=1d sum(GB) as sgb by index | addtotals

The values that I'm obtaining are in table mode like this:

_time index1 index2 index3 index4 Total

Each column has one value for each time and each index. When I select mode graph all the values are graphed.

I need create one graph for only one value (for example index1 versus time)

Thanks and regards.

0 Karma

lguinn2
Legend

The best way would be to specify the index in your search

yoursearchhere index=index1
| timechart span=1d sum(GB) as sgb

There is no way AFAIK to have the table view show all the indexes and yet have the chart show only one index.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Splunk Add-on for Microsoft Windows 11.0.3: Parse Once, Search Faster

The updated Splunk Add-on for Microsoft Windows helps customers search Windows events faster by reducing ...

What's New in Splunk Enterprise Security 8.8 and Beyond

Threats move at machine speed. Keeping up should not depend on having the biggest budget, the largest team, or ...

A Four-Part Event Series: State of Observability - Where AI Meets Performance

As AI agents take on more complex tasks, teams need greater visibility into how they behave, what they cost, ...