Splunk Search

making a chart

harsh1734
New Member

hi,
by running this query in search field
index="New" "Phase * ended" | table phaseinformation , phase_ended , datetime | rename datetime as DATE , phaseinformation as Phase_Info , phase_ended as Phase_End_Time | sort Phase_End_Time by desc

i got the following output

Phase_info Phase_End_Time DATE

phase 1 ended 1200 secs jul 16 12:04:44
phase 0 ended 1000 secs jul 16 11:02:48

now i can make chart of this by simply clicking on reports..but i am not able to get clear representation of phase_info on x axis and phase_end_time on y axis....
so need to make a clear graph..

Tags (1)
0 Karma

zeroactive
Path Finder

Without a larger data set to look at, and without more details about what you want, it's hard to provide direction. You could do a chart that provides the SUM or AVG (average) Phase_End_Time for each Phase_Info value, but just plotting the End Time values for the Phase_Info values isn't going to provide you any value over a table of the results.

0 Karma

linu1988
Champion

You can't do a chart to show that the event came at that time. Some numerical value is needed to plot a graph , e.g. time per phase_info. Thanks

0 Karma

kml_uvce
Builder

can you explain more...

kamal singh bisht
0 Karma
Get Updates on the Splunk Community!

Application management with Targeted Application Install for Victoria Experience

  Experience a new era of flexibility in managing your Splunk Cloud Platform apps! With Targeted Application ...

Index This | What goes up and never comes down?

January 2026 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Splunkers, Pack Your Bags: Why Cisco Live EMEA is Your Next Big Destination

The Power of Two: Splunk + Cisco at "Ludicrous Scale"   You know Splunk. You know Cisco. But have you seen ...