Splunk Search

chart values from search

sreynolds30
Explorer

I have a search that returns time as this:

Apr 25 2014 14:51:40 GMT: INFO (nsup): (base/thr_nsup.c:1249) {ddp-ns} Records: 17798730, 17798730 0-vt, 0(0) expired, 0(0) evicted, 0(0) set deletes, 0(0) set evicted. Evict ttls: 0,0,0.000. Waits: 0,0,0. Total time: 3169 ms

I would like to chart this total time over time but not having luck. thanks.

Tags (1)
0 Karma

sreynolds30
Explorer

I got it going thanks.

0 Karma

somesoni2
Revered Legend

If possible, add the answer that you arrived to here and accept/close the answer.

0 Karma

somesoni2
Revered Legend

This one event that you're indexing in splunk or output of a search? You could extract Total time in a field and do a timechart.

0 Karma
Get Updates on the Splunk Community!

Celebrating Fast Lane: 2025 Authorized Learning Partner of the Year

At .conf25, Splunk proudly recognized Fast Lane as the 2025 Authorized Learning Partner of the Year. This ...

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...