reverse axes

[jbrenner]

I have a Splunk query that returns the duration of each service call, and I want to plot each value on the y-axis, and a time-stamp on the x-axis.

The last part of the query is a rex command parsing out DURATION

[woodcock]

The simplest way is to use the transpose command.

[DalJeanis]

1) One simple way to do this is to use a scatter plot, with _time along the bottom and a decimal calculated minutes or seconds as your vertical axis. This gives TIME as your more important factor, and shows events that are nearly simultaneous as such.

2) Another way is to flip your axes so that the _time is vertical with oldest at the top, and the bars go to the right for duration. This makes each event equal in importance, so that time (vertically) expands or compresses so that one vertical line is one event, no matter how many happened in one moment.

It all depends on your expected data and what you plan to be doing with the results.

[somesoni2]

You should be able to do that as long as you're keeping duration (y-axis value) numeric (can't plot strings). If you can share you current query, we can suggest the necessary changes for charting the data.