Splunk Search
Highlighted

Communicator

Hi there,

I have a field with values, like 2, 4 or 10.
Now I want to use a timechart or a chart which display 2, 4 or 10 in a graph over the time. I struggeling because Splunk always use the event and not the content of the event.

when I perform a search like this

``````index=firewall | sourcetype=cisco | multikv fields connections | timechart avg(connections) by node
``````

I just get average values of the connections - I want to use the real values in the field connections without using any mathematical constructions.

Cheers

Tags (1)
1 Solution
Highlighted

## Re: Simple question about timecharts

Builder
``````index=firewall | sourcetype=cisco | multikv fields connections | bucket _time span=1h as time | chart sum(connections) over time by node
``````

you'll probably have to fool around with the span time, but that should do it.

Highlighted

## Re: Simple question about timecharts

Legend

Some explanation on how `timechart` behaves: `timechart` needs some kind of statistical function that returns a unique value for the timespan it's operating on. If you don't define the timespan yourself it will be set dynamically depending on what timerange the whole search spans, but let's take an example where the timespan is 1 minute and that somewhere in your log you have 3 of these events occurring within 1 minute. Splunk needs to know how to give you ONE value for "Value", even though there are 3 values of each. You can tell Splunk to just give you an average from the 3 events using the stats function avg, like you have done:

``````... | timechart span=1m avg(connections) by node
``````

Or, if you only want the values from the first of the events within the time period, use `first` instead of `avg`. Want the sum? Use `sum`. And so on. More information on statistical functions is available here: http://www.splunk.com/base/Documentation/latest/SearchReference/Stats

There's also a second way to do this, which is to produce a table containing timestamps and values yourself and then feed them into the chart.

``````... | table _time connections
``````
Highlighted

## Re: Simple question about timecharts

Communicator

I think we have a misunderstanding I want to know how I can use the values IN the field. for instance, connections=2 at 3 pm and connections=8 at 4 pm. So I want to have a graph which displays once the connections 2 and 8 over the time 3 and 4 pm.

For me it is important to display the real numbers in my time chart without having avg etc.
I don't need it in a table.

You know what I mean?

Highlighted

## Re: Simple question about timecharts

Legend

I know, and that's the problem I'm addressing in my answer. There are two suggested ways of solving it in there - what are your objections to either way?

Highlighted

## Re: Simple question about timecharts

Explorer

Hi

I have panels that produce a number using the stat command (stats count | where count=0] | stats count) at the end of each panels calculations with a field that ensures not n/a. What i want to do is show the trend of this number over the last 24 hours or week. I was considering using trend lines but this may work better.

So i need some formula that calculates the number of events from a previous 24 hours i am guessing the avg command and then compares this to current day so i want to see the trends but also want to know if and when this log is not working for some reason. thanks C.

Highlighted

## Re: Simple question about timecharts SplunkTrust

This question is more than 5 years old and has an accepted answer so you're unlikely to get an answer. You should post a new question.

---
If this reply helps you, an upvote would be appreciated.
Highlighted

## Re: Simple question about timecharts

Explorer

thanks Rich i tried that and nobody answered but ill try again thanks.