Simple question.. I think.. Charting field values over time

[ericrobinson]

I have a search that defines a transaction. Fields extracted are rmi_time and persist_time. How can I graph those values over time? I am not looking for the min,max or otherwise.. But the original values for each transaction.

[Stephen_Sorkin]

Although specifying an aggregation function to make the x-axis of the data table continuous and uniform with one data point for each of fewer than a few hundred points is a strong, strong suggestion, it's not essential when charting. As long as you provide a table to our charting subsystem to render individual time points, provided that there are fewer than 250 of them (any more will be discarded). Assuming that you have a search that yields events with timestamps and the values of these metrics, you can add to your search and click on "Show report":

... | table _time rmi_time persist_time

Only the most recent 250 data points will be shown in this chart.

[sideview]

Note that the same topic was dealt with quite well over at: http://answers.splunk.com/questions/10349/chart-only-showing-1000-events

[gkanapathy]

In any given time interval, there may be more than one value of rmi_time, and a graphed series will only be able to display one point for that interval. Therefore, you must specify an aggregation function, i.e., how to resolve having potential multiple values in an interval.

If you know ex ante that your chart and intervals will only ever contain at most one value, then you can simply use e.g., first(rmi_time) as rmi_time, (or any of max(), min(), avg(), sum(), median() etc. for numeric data).

[Simeon]

When you chart over time the values will likely be put into bins. In most situations, when charting those types of values you describe, using avg is the easiest. You could also use the first or last function.

http://www.splunk.com/base/Documentation/latest/SearchReference/CommonStatsFunctions