Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.

Showing results for

Splunk Search

Showing results for

- Community
- :
- Splunk Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Simple question about timecharts

- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page

- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content

nebel

Communicator

04-26-2012
08:33 AM

Hi there,

I have a field with values, like 2, 4 or 10.

Now I want to use a timechart or a chart which display 2, 4 or 10 in a graph over the time. I struggeling because Splunk always use the event and not the content of the event.

when I perform a search like this

```
index=firewall | sourcetype=cisco | multikv fields connections | timechart avg(connections) by node
```

I just get average values of the connections - I want to use the real values in the field connections without using any mathematical constructions.

Thanks in advance

Cheers

1 Solution

- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content

Ayn

Legend

04-26-2012
12:57 PM

Some explanation on how `timechart`

behaves: `timechart`

needs some kind of statistical function that returns a unique value for the timespan it's operating on. If you don't define the timespan yourself it will be set dynamically depending on what timerange the whole search spans, but let's take an example where the timespan is 1 minute and that somewhere in your log you have 3 of these events occurring within 1 minute. Splunk needs to know how to give you ONE value for "Value", even though there are 3 values of each. You can tell Splunk to just give you an average from the 3 events using the stats function avg, like you have done:

```
... | timechart span=1m avg(connections) by node
```

Or, if you only want the values from the first of the events within the time period, use `first`

instead of `avg`

. Want the sum? Use `sum`

. And so on. More information on statistical functions is available here: http://www.splunk.com/base/Documentation/latest/SearchReference/Stats

There's also a second way to do this, which is to produce a table containing timestamps and values yourself and then feed them into the chart.

```
... | table _time connections
```

- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content

colinmchugo

Explorer

07-12-2017
07:46 AM

Hi

I have panels that produce a number using the stat command (stats count | where count=0] | stats count) at the end of each panels calculations with a field that ensures not n/a. What i want to do is show the trend of this number over the last 24 hours or week. I was considering using trend lines but this may work better.

So i need some formula that calculates the number of events from a previous 24 hours i am guessing the avg command and then compares this to current day so i want to see the trends but also want to know if and when this log is not working for some reason. thanks C.

- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content

richgalloway

SplunkTrust

07-12-2017
08:16 AM

This question is more than 5 years old and has an accepted answer so you're unlikely to get an answer. You should post a new question.

---

If this reply helps you, an upvote would be appreciated.

If this reply helps you, an upvote would be appreciated.

- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content

colinmchugo

Explorer

07-12-2017
09:38 AM

thanks Rich i tried that and nobody answered but ill try again thanks.

- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content

nebel

Communicator

04-26-2012
12:59 PM

I think we have a misunderstanding I want to know how I can use the values IN the field. for instance, connections=2 at 3 pm and connections=8 at 4 pm. So I want to have a graph which displays once the connections 2 and 8 over the time 3 and 4 pm.

For me it is important to display the real numbers in my time chart without having avg etc.

I don't need it in a table.

You know what I mean?

- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content

Ayn

Legend

04-26-2012
01:51 PM

- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content

Ayn

Legend

04-26-2012
12:57 PM

Some explanation on how `timechart`

behaves: `timechart`

needs some kind of statistical function that returns a unique value for the timespan it's operating on. If you don't define the timespan yourself it will be set dynamically depending on what timerange the whole search spans, but let's take an example where the timespan is 1 minute and that somewhere in your log you have 3 of these events occurring within 1 minute. Splunk needs to know how to give you ONE value for "Value", even though there are 3 values of each. You can tell Splunk to just give you an average from the 3 events using the stats function avg, like you have done:

```
... | timechart span=1m avg(connections) by node
```

Or, if you only want the values from the first of the events within the time period, use `first`

instead of `avg`

. Want the sum? Use `sum`

. And so on. More information on statistical functions is available here: http://www.splunk.com/base/Documentation/latest/SearchReference/Stats

There's also a second way to do this, which is to produce a table containing timestamps and values yourself and then feed them into the chart.

```
... | table _time connections
```

- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content

RicoSuave

Builder

04-26-2012
12:38 PM

```
index=firewall | sourcetype=cisco | multikv fields connections | bucket _time span=1h as time | chart sum(connections) over time by node
```

you'll probably have to fool around with the span time, but that should do it.