Splunk Search

chart graph help

surekhasplunk
Communicator

Hello,

I have data in a lookup file which i am appending everyday instead of indexing. 

Time Device Infra Average Tool1 Tool2
11/26/2020 03:56 6223 95 88.41 95.69
11/27/2020 03:56 6220 94 88.39 95.74

And in the lookup file i have data in above format. 

What is the best way to show in a graph/chart the evolution of each field by Time 

Thanks

Labels (2)
Tags (3)
0 Karma

to4kawa
Ultra Champion
index=_internal | head 1 | fields _raw | eval _raw="Time Device Infra Average Tool1 Tool2
11/26/2020 03:56 6223 95 88.41 95.69
11/27/2020 03:56 6220 94 88.39 95.74"
| multikv 
| eval _time=strptime(Time." ".Device,"%m/%d/%Y %H:%M")
| table _time Infra Average Tool1 Tool2

>What is the best way to show in a graph/chart the evolution of each field by Time 
The data doesn't explain anything about the meaning of.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

What are you trying to achieve? Why are you collecting the data? What insights do you hope to get from your charts/graphs? How does your data change over time? Answer some of these questions and it would easier to help you.

0 Karma

surekhasplunk
Communicator

What are you trying to achieve?  to see the trend of the numbers changing each day

Why are you collecting the data? to see the percentage of devices monitored in some of our tools. And work on the missing ones. 

What insights do you hope to get from your charts/graphs? How does your data change over time?

every day/ every week once i am planning to append the csv file . from the chart/graph i need to show the change of numbers over time 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Have you loaded the file (inputlookup)? Use fields to list the fields you are interested in starting with the time field so it becomes the x-axis, then select the line graph visualisation

0 Karma

surekhasplunk
Communicator

Yes i did load the lookup file. 

Use fields to list the fields you are interested in starting with the time field so it becomes the x-axis, then select the line graph visualisation

(Here i wanted the query if can can help me with the exact query it will be helpful. )

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

What have you tried so far?

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

May 2026 Splunk Expert Sessions: Security & Observability

Level Up Your Operations: May 2026 Splunk Expert Sessions Whether you are refining your security posture or ...

Network to App: Observability Unlocked [May & June Series]

In today’s digital landscape, your environment is no longer confined to the data center. It spans complex ...

SPL2 Deep Dives, AppDynamics Integrations, SAML Made Simple and Much More on Splunk ...

Splunk Lantern is Splunk’s customer success center that provides practical guidance from Splunk experts on key ...